diff --git a/class/defaults.yml b/class/defaults.yml index 1b5df88..b33ddbb 100644 --- a/class/defaults.yml +++ b/class/defaults.yml @@ -16,7 +16,7 @@ parameters: charts: external-secrets: source: https://charts.external-secrets.io - version: 2.8.0 + version: 2.14.0 helm_values: image: diff --git a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/cert-controller-deployment.yaml b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/cert-controller-deployment.yaml index 1c63483..6cb73c4 100644 --- a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/cert-controller-deployment.yaml +++ b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/cert-controller-deployment.yaml @@ -6,8 +6,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/metrics: cert-controller app.kubernetes.io/name: external-secrets-cert-controller - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 name: external-secrets-cert-controller namespace: syn-external-secrets-operator spec: @@ -24,8 +24,8 @@ spec: app.kubernetes.io/managed-by: Helm app.kubernetes.io/metrics: cert-controller app.kubernetes.io/name: external-secrets-cert-controller - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 spec: automountServiceAccountToken: true containers: @@ -41,7 +41,7 @@ spec: - --loglevel=info - --zap-time-encoding=epoch - --enable-partial-cache=true - image: ghcr.io/external-secrets/external-secrets:v2.8.0 + image: ghcr.io/external-secrets/external-secrets:v2.14.0 imagePullPolicy: IfNotPresent name: cert-controller ports: diff --git a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/cert-controller-rbac.yaml b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/cert-controller-rbac.yaml index 790da9e..0027513 100644 --- a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/cert-controller-rbac.yaml +++ b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/cert-controller-rbac.yaml @@ -6,8 +6,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/metrics: cert-controller app.kubernetes.io/name: external-secrets-cert-controller - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 name: external-secrets-cert-controller rules: - apiGroups: @@ -105,8 +105,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/metrics: cert-controller app.kubernetes.io/name: external-secrets-cert-controller - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 name: external-secrets-cert-controller roleRef: apiGroup: rbac.authorization.k8s.io diff --git a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/cert-controller-service.yaml b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/cert-controller-service.yaml index a2c715b..9297d44 100644 --- a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/cert-controller-service.yaml +++ b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/cert-controller-service.yaml @@ -6,8 +6,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/metrics: cert-controller app.kubernetes.io/name: external-secrets-cert-controller - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 name: external-secrets-cert-controller-metrics namespace: syn-external-secrets-operator spec: diff --git a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/cert-controller-serviceaccount.yaml b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/cert-controller-serviceaccount.yaml index c3f0373..7c40f4a 100644 --- a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/cert-controller-serviceaccount.yaml +++ b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/cert-controller-serviceaccount.yaml @@ -6,7 +6,7 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/metrics: cert-controller app.kubernetes.io/name: external-secrets-cert-controller - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 name: external-secrets-cert-controller namespace: syn-external-secrets-operator diff --git a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/acraccesstoken.yaml b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/acraccesstoken.yaml index 9c86191..6ecd164 100644 --- a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/acraccesstoken.yaml +++ b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/acraccesstoken.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: acraccesstokens.generators.external-secrets.io @@ -148,8 +148,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array diff --git a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/beyondtrustworkloadcredentialsdynamicsecret.yaml b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/beyondtrustworkloadcredentialsdynamicsecret.yaml index 246bd18..0b9d6d5 100644 --- a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/beyondtrustworkloadcredentialsdynamicsecret.yaml +++ b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/beyondtrustworkloadcredentialsdynamicsecret.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: beyondtrustworkloadcredentialsdynamicsecrets.generators.external-secrets.io diff --git a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/cloudsmithaccesstoken.yaml b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/cloudsmithaccesstoken.yaml index 468fb02..a906904 100644 --- a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/cloudsmithaccesstoken.yaml +++ b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/cloudsmithaccesstoken.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: cloudsmithaccesstokens.generators.external-secrets.io @@ -58,8 +58,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array diff --git a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/clusterexternalsecret.yaml b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/clusterexternalsecret.yaml index c634822..46a3164 100644 --- a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/clusterexternalsecret.yaml +++ b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/clusterexternalsecret.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: clusterexternalsecrets.external-secrets.io @@ -93,15 +93,15 @@ spec: which secret (version/property/..) to fetch. properties: conversionStrategy: - default: Default - description: Used to define a conversion Strategy + description: Used to define a conversion Strategy. + Defaults to Default when omitted. enum: - Default - Unicode type: string decodingStrategy: - default: None - description: Used to define a decoding Strategy + description: Used to define a decoding Strategy. Defaults + to None when omitted. enum: - Auto - Base64 @@ -113,7 +113,6 @@ spec: mandatory type: string metadataPolicy: - default: None description: Policy for fetching tags/labels from provider secrets, possible options are Fetch, None. Defaults to None @@ -239,15 +238,15 @@ spec: Note: Extract does not support sourceRef.Generator or sourceRef.GeneratorRef. properties: conversionStrategy: - default: Default - description: Used to define a conversion Strategy + description: Used to define a conversion Strategy. + Defaults to Default when omitted. enum: - Default - Unicode type: string decodingStrategy: - default: None - description: Used to define a decoding Strategy + description: Used to define a decoding Strategy. Defaults + to None when omitted. enum: - Auto - Base64 @@ -259,7 +258,6 @@ spec: mandatory type: string metadataPolicy: - default: None description: Policy for fetching tags/labels from provider secrets, possible options are Fetch, None. Defaults to None @@ -291,15 +289,15 @@ spec: Note: Find does not support sourceRef.Generator or sourceRef.GeneratorRef. properties: conversionStrategy: - default: Default - description: Used to define a conversion Strategy + description: Used to define a conversion Strategy. + Defaults to Default when omitted. enum: - Default - Unicode type: string decodingStrategy: - default: None - description: Used to define a decoding Strategy + description: Used to define a decoding Strategy. Defaults + to None when omitted. enum: - Auto - Base64 @@ -780,14 +778,15 @@ spec: default: Data description: |- Target specifies where to place the template result. - For Secret resources, common values are: "Data", "Annotations", "Labels". + For Secret resources the accepted values are empty, "Data", "Annotations" and "Labels"; + any other value is rejected because it would allow writes to privileged Secret fields. For custom resources (when spec.target.manifest is set), this supports nested paths like "spec.database.config" or "data". type: string valuesDecodingStrategy: - default: None - description: Used to define a decoding Strategy - for the rendered template values. + description: |- + Used to define a decoding Strategy for the rendered template values. + Defaults to None when omitted. enum: - Auto - Base64 diff --git a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/clustergenerator.yaml b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/clustergenerator.yaml index 096f92a..9bc27be 100644 --- a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/clustergenerator.yaml +++ b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/clustergenerator.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: clustergenerators.generators.external-secrets.io @@ -150,8 +150,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -396,8 +396,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -446,8 +446,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -650,8 +650,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -788,8 +788,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -826,7 +826,38 @@ spec: to generate a GitHub access token. properties: appID: + description: AppID is the GitHub App ID. Exactly one of + AppID or AppIDRef must be set. type: string + appIDRef: + description: AppIDRef references a secret key containing + the GitHub App ID. Exactly one of AppID or AppIDRef must + be set. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred + to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object auth: description: Auth configures how ESO authenticates with a Github instance. @@ -871,7 +902,38 @@ spec: - privateKey type: object installID: + description: InstallID is the GitHub App installation ID. + Exactly one of InstallID or InstallIDRef must be set. type: string + installIDRef: + description: |- + InstallIDRef references a secret key containing the GitHub App installation ID. Exactly one of InstallID or + InstallIDRef must be set. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred + to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object permissions: additionalProperties: type: string @@ -890,10 +952,17 @@ spec: to https://github.com/. type: string required: - - appID - auth - - installID type: object + x-kubernetes-validations: + - message: exactly one of the fields in [appID appIDRef] must + be set + rule: (has(self.appID)?1:0)+(has(self.appIDRef)?1:0) == + 1 + - message: exactly one of the fields in [installID installIDRef] + must be set + rule: (has(self.installID)?1:0)+(has(self.installIDRef)?1:0) + == 1 gitlabDeployTokenSpec: description: GitlabDeployTokenSpec defines the desired state to generate a GitLab deploy token. @@ -1191,6 +1260,11 @@ spec: default: false description: Set NoUpper to disable uppercase characters type: boolean + prefix: + description: |- + Prefix is prepended to every generated password after encoding. + It is not counted in length or subject to the character settings. + type: string secretKeys: description: |- SecretKeys defines the keys that will be populated with generated passwords. @@ -1199,6 +1273,11 @@ spec: type: string minItems: 1 type: array + suffix: + description: |- + Suffix is appended to every generated password after encoding. + It is not counted in length or subject to the character settings. + type: string symbolCharacters: description: |- SymbolCharacters specifies the special characters that should be used @@ -1229,8 +1308,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -1305,8 +1384,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -1714,8 +1793,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -1763,8 +1842,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -1812,8 +1891,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -1990,8 +2069,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -2116,8 +2195,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array diff --git a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/clusterpushsecret.yaml b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/clusterpushsecret.yaml index 2bc95a8..d5d8dec 100644 --- a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/clusterpushsecret.yaml +++ b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/clusterpushsecret.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: clusterpushsecrets.external-secrets.io @@ -654,14 +654,15 @@ spec: default: Data description: |- Target specifies where to place the template result. - For Secret resources, common values are: "Data", "Annotations", "Labels". + For Secret resources the accepted values are empty, "Data", "Annotations" and "Labels"; + any other value is rejected because it would allow writes to privileged Secret fields. For custom resources (when spec.target.manifest is set), this supports nested paths like "spec.database.config" or "data". type: string valuesDecodingStrategy: - default: None - description: Used to define a decoding Strategy for - the rendered template values. + description: |- + Used to define a decoding Strategy for the rendered template values. + Defaults to None when omitted. enum: - Auto - Base64 diff --git a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/clustersecretstore.yaml b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/clustersecretstore.yaml index 74f753d..6ed1c03 100644 --- a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/clustersecretstore.yaml +++ b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/clustersecretstore.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: clustersecretstores.external-secrets.io @@ -204,8 +204,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -332,8 +332,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -437,8 +437,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -839,8 +839,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -888,6 +888,92 @@ spec: description: BarbicanAuth contains the authentication information for Barbican. properties: + applicationCredentialID: + description: ID of the application credential used for + authentication. + maxProperties: 1 + minProperties: 1 + properties: + secretRef: + description: |- + SecretKeySelector is a reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource + being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + value: + minLength: 1 + type: string + type: object + applicationCredentialSecret: + description: BarbicanProviderAppCredSecretRef defines + a reference to an Application Credential Secret. + properties: + secretRef: + description: |- + SecretKeySelector is a reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource + being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - secretRef + type: object + authType: + default: password + description: |- + AuthType selects how Barbican authenticates. + - "password": use username and password. + - "applicationCredential": use application credential ID and secret. + Defaults to "password". + enum: + - password + - applicationCredential + type: string password: description: BarbicanProviderPasswordRef defines a reference to a secret containing password for the Barbican provider. @@ -925,8 +1011,7 @@ spec: - secretRef type: object username: - description: BarbicanProviderUsernameRef defines a reference - to a secret containing username for the Barbican provider. + description: Username / Password authentication fields. maxProperties: 1 minProperties: 1 properties: @@ -960,12 +1045,26 @@ spec: type: string type: object value: + minLength: 1 type: string type: object - required: - - password - - username type: object + x-kubernetes-validations: + - message: password auth requires both username and password + rule: (has(self.authType) && self.authType == 'applicationCredential') + || (has(self.username) && has(self.password)) + - message: applicationCredential auth requires both applicationCredentialID + and applicationCredentialSecret + rule: self.authType != 'applicationCredential' || (has(self.applicationCredentialID) + && has(self.applicationCredentialSecret)) + - message: password auth should not include applicationCredential + fields + rule: (has(self.authType) && self.authType == 'applicationCredential') + || (!has(self.applicationCredentialID) && !has(self.applicationCredentialSecret)) + - message: applicationCredential auth should not include + password fields + rule: self.authType != 'applicationCredential' || (!has(self.username) + && !has(self.password)) authURL: type: string domainName: @@ -1668,6 +1767,65 @@ spec: - apiKeyRef - userRef type: object + azure: + description: Azure enables authentication to Conjur + via the authn-azure authenticator. + properties: + account: + description: Account is the Conjur organization + account name. + type: string + clientId: + description: |- + ClientID is the Azure managed identity client ID. Required for user-assigned + managed identities; omit for system-assigned identities. + type: string + hostId: + description: |- + HostID is the Conjur host mapped to the Azure managed identity + (e.g. "data/myapp/myhost"). + type: string + serviceAccountRef: + description: |- + ServiceAccountRef specifies the Kubernetes service account for which to request + a token via the TokenRequest API. That token is used as the Azure JWT for Conjur + authn-azure. If omitted, the token is fetched from the Azure IMDS endpoint instead. + properties: + audiences: + description: |- + Audience specifies the `aud` claim for the service account token + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) + items: + type: string + type: array + name: + description: The name of the ServiceAccount + resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + Namespace of the resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + serviceID: + description: ServiceID is the Conjur authn-azure + webservice identifier (e.g. "prod"). + type: string + required: + - account + - hostId + - serviceID + type: object cert: description: Cert enables certificate-based authentication using a client certificate and key. @@ -1747,6 +1905,189 @@ spec: - clientKeyRef - serviceID type: object + gcp: + description: GCP enables authentication to Conjur via + the authn-gcp authenticator. + properties: + account: + description: Account is the Conjur organization + account name. + type: string + hostId: + description: |- + HostID is the Conjur host mapped to the GCP service account + (e.g. "data/myapp/myhost"). + type: string + secretRef: + description: |- + SecretRef holds a reference to a Kubernetes Secret containing a pre-obtained + GCP identity token. If omitted, the token is fetched from the GCP Metadata + Service automatically (requires GKE Workload Identity or a GCE/GKE node). + properties: + jwt: + description: JWT is a reference to the Kubernetes + Secret key holding the GCP identity token. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource + being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - jwt + type: object + serviceID: + description: |- + ServiceID is the Conjur authn-gcp webservice identifier (e.g. "prod"). + Note: Conjur's authn-gcp authenticator does not include the service ID in the + authentication URL; this field is reserved for future use. + type: string + required: + - account + - hostId + type: object + iam: + description: IAM enables authentication to Conjur via + the authn-iam authenticator. + properties: + account: + description: Account is the Conjur organization + account name. + type: string + hostId: + description: |- + HostID is the Conjur host mapped to the AWS IAM role + (e.g. "data/myapp/123456789012/MyRole"). + type: string + insecure: + description: |- + Insecure allows authenticating to Conjur over plain HTTP. The AWS IAM authenticator + sends a signed request as a bearer credential, so this should only be enabled when the + connection is otherwise protected (e.g. a service mesh sidecar terminating TLS). + type: boolean + secretRef: + description: |- + SecretRef holds optional references to Kubernetes Secrets containing explicit + AWS credentials. If omitted, the default AWS SDK credential chain is used + (IRSA, instance metadata, environment variables, etc.). + properties: + accessKeyIDSecretRef: + description: A reference to a Secret key containing + the AWS Access Key ID. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource + being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + secretAccessKeySecretRef: + description: A reference to a Secret key containing + the AWS Secret Access Key. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource + being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + sessionTokenSecretRef: + description: |- + A reference to a Secret key containing the AWS Session Token. + Required only when using temporary credentials. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource + being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - accessKeyIDSecretRef + - secretAccessKeySecretRef + type: object + serviceID: + description: ServiceID is the Conjur authn-iam webservice + identifier (e.g. "prod"). + type: string + required: + - account + - hostId + - serviceID + type: object jwt: description: Jwt enables JWT authentication using Kubernetes service account tokens. @@ -1797,8 +2138,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -1966,8 +2307,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -2175,8 +2516,7 @@ spec: rule: has(self.auth) || has(self.authRef) - message: at most one of the fields in [auth authRef] may be set - rule: '[has(self.auth),has(self.authRef)].filter(x,x==true).size() - <= 1' + rule: (has(self.auth)?1:0)+(has(self.authRef)?1:0) <= 1 delinea: description: |- Delinea DevOps Secrets Vault @@ -2302,8 +2642,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -2629,8 +2969,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -2765,8 +3105,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -2809,7 +3149,7 @@ spec: type: object github: description: |- - Github configures this store to push GitHub Actions secrets using the GitHub API provider. + Github configures this store to push GitHub Actions or Dependabot secrets using the GitHub API provider. Note: This provider only supports write operations (PushSecret) and cannot fetch secrets from GitHub properties: appID: @@ -2880,6 +3220,15 @@ spec: description: repository will be used to fetch secrets from the Github repository within an organization type: string + secretType: + default: Actions + description: |- + secretType specifies which GitHub secret service to use. + Defaults to Actions for backwards compatibility. + enum: + - Actions + - Dependabot + type: string uploadURL: description: Upload URL for enterprise instances. Default to URL. @@ -2895,6 +3244,10 @@ spec: - installationID - organization type: object + x-kubernetes-validations: + - message: Dependabot secrets do not support environments + rule: self.secretType != 'Dependabot' || !has(self.environment) + || size(self.environment) == 0 gitlab: description: GitLab configures this store to sync secrets using GitLab Variables provider @@ -3963,7 +4316,6 @@ spec: type: boolean required: - authRef - - folderID type: object kubernetes: description: Kubernetes configures this store to sync secrets @@ -4047,8 +4399,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -4269,11 +4621,63 @@ spec: pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string type: object + workloadIdentity: + description: WorkloadIdentity defines configuration + for workload identity authentication to Nebius IAM. + properties: + iamServiceAccountID: + description: |- + IAMServiceAccountID is the Nebius IAM service account identifier that the + federated Kubernetes service account should impersonate during token exchange. + example: serviceaccount-e00example + minLength: 1 + pattern: ^serviceaccount-[a-z][a-z0-9]{2} + type: string + serviceAccountRef: + description: |- + ServiceAccountRef references a Kubernetes ServiceAccount used to request a + temporary JWT via the TokenRequest API. The JWT is then exchanged for a + Nebius IAM token using workload federation. + properties: + audiences: + description: |- + Audience specifies the `aud` claim for the service account token + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) + items: + type: string + type: array + name: + description: The name of the ServiceAccount + resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + Namespace of the resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + required: + - iamServiceAccountID + - serviceAccountRef + type: object type: object x-kubernetes-validations: - - message: either serviceAccountCredsSecretRef or tokenSecretRef - must be set - rule: has(self.serviceAccountCredsSecretRef) || has(self.tokenSecretRef) + - message: exactly one of serviceAccountCredsSecretRef, + tokenSecretRef, or workloadIdentity must be set + rule: '(has(self.serviceAccountCredsSecretRef) && has(self.serviceAccountCredsSecretRef.name) + && size(self.serviceAccountCredsSecretRef.name) > + 0 ? 1 : 0) + (has(self.tokenSecretRef) && has(self.tokenSecretRef.name) + && size(self.tokenSecretRef.name) > 0 ? 1 : 0) + (has(self.workloadIdentity) + ? 1 : 0) == 1' caProvider: description: The provider for the CA bundle to use to validate NebiusMysterybox server certificate. @@ -4587,6 +4991,12 @@ spec: Format: duration string (e.g., "5m", "1h", "30s") type: string type: object + environment: + description: |- + Environment defines the 1Password Environment ID to read variables from. + Environments are read-only: PushSecret, DeleteSecret, and SecretExists return an error when set. + Mutually exclusive with Vault. + type: string integrationInfo: description: |- IntegrationInfo specifies the name and version of the integration built using the 1Password Go SDK. @@ -4602,13 +5012,18 @@ spec: type: string type: object vault: - description: Vault defines the vault's name or uuid to access. - Do NOT add op:// prefix. This will be done automatically. + description: |- + Vault defines the vault's name or uuid to access. Do NOT add op:// prefix. This will be done automatically. + Mutually exclusive with Environment. type: string required: - auth - - vault type: object + x-kubernetes-validations: + - message: at most one of the fields in [vault environment] + may be set + rule: (has(self.vault)?1:0)+(has(self.environment)?1:0) + <= 1 openBao: description: OpenBao configures this store to sync secrets using the OpenBao provider. @@ -4705,8 +5120,99 @@ spec: x-kubernetes-validations: - message: exactly one of the fields in [roleId roleRef] must be set - rule: '[has(self.roleId),has(self.roleRef)].filter(x,x==true).size() - == 1' + rule: (has(self.roleId)?1:0)+(has(self.roleRef)?1:0) + == 1 + kubernetes: + description: |- + Kubernetes authenticates with OpenBao by passing a ServiceAccount + token to the [Kubernetes auth mechanism]. + + [Kubernetes auth mechanism]: https://openbao.org/docs/auth/kubernetes/ + properties: + path: + default: kubernetes + description: |- + Path where the Kubernetes authentication backend is mounted in OpenBao, e.g: + "kubernetes" + type: string + role: + description: |- + A required field containing the OpenBao Role to assume. A Role binds a + Kubernetes ServiceAccount with a set of OpenBao policies. + minLength: 1 + type: string + secretRef: + description: |- + Optional secret field containing a Kubernetes ServiceAccount JWT used + for authenticating with OpenBao. If a name is specified without a key, + `token` is the default. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource + being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + serviceAccountRef: + description: |- + Optional service account field containing the name of a Kubernetes ServiceAccount. + If the service account is specified, a token will be requested from the Kubernetes + TokenRequest API for authenticating with OpenBao. + Any configured audiences will be passed to the TokenRequest as-is. + properties: + audiences: + description: |- + Audience specifies the `aud` claim for the service account token + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) + items: + type: string + type: array + name: + description: The name of the ServiceAccount + resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + Namespace of the resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + required: + - path + - role + type: object + x-kubernetes-validations: + - message: exactly one of the fields in [serviceAccountRef + secretRef] must be set + rule: (has(self.serviceAccountRef)?1:0)+(has(self.secretRef)?1:0) + == 1 namespace: description: |- Name of the [OpenBao Namespace] to authenticate to. This can be different @@ -4801,9 +5307,9 @@ spec: type: object x-kubernetes-validations: - message: exactly one of the fields in [appRole tokenSecretRef - userPass] must be set - rule: '[has(self.appRole),has(self.tokenSecretRef),has(self.userPass)].filter(x,x==true).size() - == 1' + userPass kubernetes] must be set + rule: (has(self.appRole)?1:0)+(has(self.tokenSecretRef)?1:0)+(has(self.userPass)?1:0)+(has(self.kubernetes)?1:0) + == 1 caBundle: description: |- PEM encoded CA bundle used to validate the OpenBao server certificate. If @@ -4884,8 +5390,8 @@ spec: x-kubernetes-validations: - message: at most one of the fields in [caBundle caProvider] may be set - rule: '[has(self.caBundle),has(self.caProvider)].filter(x,x==true).size() - <= 1' + rule: (has(self.caBundle)?1:0)+(has(self.caProvider)?1:0) + <= 1 oracle: description: Oracle configures this store to sync secrets using Oracle Vault provider @@ -5003,8 +5509,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -5538,8 +6044,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -5741,6 +6247,11 @@ spec: - name - type type: object + disableSiteIDValidation: + description: |- + DisableSiteIDValidation permits a missing site ID for new secrets. + The provider sends 0 if no site ID is set. + type: boolean domain: description: Domain is the secret server domain. type: string @@ -5791,6 +6302,13 @@ spec: ServerURL URL to your secret server installation type: string + siteId: + description: |- + SiteID is the ID of the Secret Server site for new secrets. + PushSecret metadata can override this value for one secret. + The provider uses 1 if this field is not set. + minimum: 1 + type: integer token: description: |- Token is an access token used to authenticate to the secret server, @@ -6170,8 +6688,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -6219,8 +6737,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -6268,8 +6786,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -6444,8 +6962,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -6570,8 +7088,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -7651,8 +8169,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -7941,8 +8459,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -8281,8 +8799,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -8919,8 +9437,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -9356,8 +9874,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -9881,8 +10399,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -10290,8 +10808,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -10979,8 +11497,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -11155,8 +11673,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -11281,8 +11799,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array diff --git a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/ecrauthorizationtoken.yaml b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/ecrauthorizationtoken.yaml index 74f6b49..2fdd439 100644 --- a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/ecrauthorizationtoken.yaml +++ b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/ecrauthorizationtoken.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: ecrauthorizationtokens.generators.external-secrets.io @@ -63,8 +63,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array diff --git a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/externalsecret.yaml b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/externalsecret.yaml index e84ec95..cc88c53 100644 --- a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/externalsecret.yaml +++ b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/externalsecret.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: externalsecrets.external-secrets.io @@ -79,15 +79,15 @@ spec: which secret (version/property/..) to fetch. properties: conversionStrategy: - default: Default - description: Used to define a conversion Strategy + description: Used to define a conversion Strategy. Defaults + to Default when omitted. enum: - Default - Unicode type: string decodingStrategy: - default: None - description: Used to define a decoding Strategy + description: Used to define a decoding Strategy. Defaults + to None when omitted. enum: - Auto - Base64 @@ -98,7 +98,6 @@ spec: description: Key is the key used in the Provider, mandatory type: string metadataPolicy: - default: None description: Policy for fetching tags/labels from provider secrets, possible options are Fetch, None. Defaults to None @@ -222,15 +221,15 @@ spec: Note: Extract does not support sourceRef.Generator or sourceRef.GeneratorRef. properties: conversionStrategy: - default: Default - description: Used to define a conversion Strategy + description: Used to define a conversion Strategy. Defaults + to Default when omitted. enum: - Default - Unicode type: string decodingStrategy: - default: None - description: Used to define a decoding Strategy + description: Used to define a decoding Strategy. Defaults + to None when omitted. enum: - Auto - Base64 @@ -241,7 +240,6 @@ spec: description: Key is the key used in the Provider, mandatory type: string metadataPolicy: - default: None description: Policy for fetching tags/labels from provider secrets, possible options are Fetch, None. Defaults to None @@ -273,15 +271,15 @@ spec: Note: Find does not support sourceRef.Generator or sourceRef.GeneratorRef. properties: conversionStrategy: - default: Default - description: Used to define a conversion Strategy + description: Used to define a conversion Strategy. Defaults + to Default when omitted. enum: - Default - Unicode type: string decodingStrategy: - default: None - description: Used to define a decoding Strategy + description: Used to define a decoding Strategy. Defaults + to None when omitted. enum: - Auto - Base64 @@ -755,14 +753,15 @@ spec: default: Data description: |- Target specifies where to place the template result. - For Secret resources, common values are: "Data", "Annotations", "Labels". + For Secret resources the accepted values are empty, "Data", "Annotations" and "Labels"; + any other value is rejected because it would allow writes to privileged Secret fields. For custom resources (when spec.target.manifest is set), this supports nested paths like "spec.database.config" or "data". type: string valuesDecodingStrategy: - default: None - description: Used to define a decoding Strategy for - the rendered template values. + description: |- + Used to define a decoding Strategy for the rendered template values. + Defaults to None when omitted. enum: - Auto - Base64 diff --git a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/fake.yaml b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/fake.yaml index 4859cf5..e7f2ce6 100644 --- a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/fake.yaml +++ b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/fake.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: fakes.generators.external-secrets.io diff --git a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/gcraccesstoken.yaml b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/gcraccesstoken.yaml index 6750ae0..42f47b7 100644 --- a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/gcraccesstoken.yaml +++ b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/gcraccesstoken.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: gcraccesstokens.generators.external-secrets.io @@ -98,8 +98,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -233,8 +233,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array diff --git a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/generatorstate.yaml b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/generatorstate.yaml index f2e2cb7..aa6aa0a 100644 --- a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/generatorstate.yaml +++ b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/generatorstate.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: generatorstates.generators.external-secrets.io diff --git a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/githubaccesstoken.yaml b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/githubaccesstoken.yaml index 5837754..ade70a3 100644 --- a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/githubaccesstoken.yaml +++ b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/githubaccesstoken.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: githubaccesstokens.generators.external-secrets.io @@ -45,7 +45,37 @@ spec: a GitHub access token. properties: appID: + description: AppID is the GitHub App ID. Exactly one of AppID or + AppIDRef must be set. type: string + appIDRef: + description: AppIDRef references a secret key containing the GitHub + App ID. Exactly one of AppID or AppIDRef must be set. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred + to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object auth: description: Auth configures how ESO authenticates with a Github instance. @@ -90,7 +120,38 @@ spec: - privateKey type: object installID: + description: InstallID is the GitHub App installation ID. Exactly + one of InstallID or InstallIDRef must be set. type: string + installIDRef: + description: |- + InstallIDRef references a secret key containing the GitHub App installation ID. Exactly one of InstallID or + InstallIDRef must be set. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred + to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object permissions: additionalProperties: type: string @@ -109,10 +170,15 @@ spec: https://github.com/. type: string required: - - appID - auth - - installID type: object + x-kubernetes-validations: + - message: exactly one of the fields in [appID appIDRef] must be set + rule: (has(self.appID)?1:0)+(has(self.appIDRef)?1:0) == 1 + - message: exactly one of the fields in [installID installIDRef] must + be set + rule: (has(self.installID)?1:0)+(has(self.installIDRef)?1:0) == + 1 type: object served: true storage: true diff --git a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/gitlabdeploytoken.yaml b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/gitlabdeploytoken.yaml index 4ec9b10..a35383f 100644 --- a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/gitlabdeploytoken.yaml +++ b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/gitlabdeploytoken.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: gitlabdeploytokens.generators.external-secrets.io diff --git a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/grafana.yaml b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/grafana.yaml index b477af1..7791a6e 100644 --- a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/grafana.yaml +++ b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/grafana.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: grafanas.generators.external-secrets.io diff --git a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/mfa.yaml b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/mfa.yaml index 6c8887f..f07814f 100644 --- a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/mfa.yaml +++ b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/mfa.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: mfas.generators.external-secrets.io diff --git a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/password.yaml b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/password.yaml index b7c9e20..84553a1 100644 --- a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/password.yaml +++ b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/password.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: passwords.generators.external-secrets.io @@ -82,6 +82,11 @@ spec: default: false description: Set NoUpper to disable uppercase characters type: boolean + prefix: + description: |- + Prefix is prepended to every generated password after encoding. + It is not counted in length or subject to the character settings. + type: string secretKeys: description: |- SecretKeys defines the keys that will be populated with generated passwords. @@ -90,6 +95,11 @@ spec: type: string minItems: 1 type: array + suffix: + description: |- + Suffix is appended to every generated password after encoding. + It is not counted in length or subject to the character settings. + type: string symbolCharacters: description: |- SymbolCharacters specifies the special characters that should be used diff --git a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/pushsecret.yaml b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/pushsecret.yaml index ab1df8a..bfa45aa 100644 --- a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/pushsecret.yaml +++ b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/pushsecret.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: pushsecrets.external-secrets.io @@ -576,14 +576,15 @@ spec: default: Data description: |- Target specifies where to place the template result. - For Secret resources, common values are: "Data", "Annotations", "Labels". + For Secret resources the accepted values are empty, "Data", "Annotations" and "Labels"; + any other value is rejected because it would allow writes to privileged Secret fields. For custom resources (when spec.target.manifest is set), this supports nested paths like "spec.database.config" or "data". type: string valuesDecodingStrategy: - default: None - description: Used to define a decoding Strategy for the - rendered template values. + description: |- + Used to define a decoding Strategy for the rendered template values. + Defaults to None when omitted. enum: - Auto - Base64 diff --git a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/quayaccesstoken.yaml b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/quayaccesstoken.yaml index d0ccb40..7aff3c5 100644 --- a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/quayaccesstoken.yaml +++ b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/quayaccesstoken.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: quayaccesstokens.generators.external-secrets.io @@ -54,8 +54,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array diff --git a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/secretstore.yaml b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/secretstore.yaml index 29098d1..c20d905 100644 --- a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/secretstore.yaml +++ b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/secretstore.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: secretstores.external-secrets.io @@ -204,8 +204,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -332,8 +332,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -437,8 +437,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -839,8 +839,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -888,6 +888,92 @@ spec: description: BarbicanAuth contains the authentication information for Barbican. properties: + applicationCredentialID: + description: ID of the application credential used for + authentication. + maxProperties: 1 + minProperties: 1 + properties: + secretRef: + description: |- + SecretKeySelector is a reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource + being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + value: + minLength: 1 + type: string + type: object + applicationCredentialSecret: + description: BarbicanProviderAppCredSecretRef defines + a reference to an Application Credential Secret. + properties: + secretRef: + description: |- + SecretKeySelector is a reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource + being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - secretRef + type: object + authType: + default: password + description: |- + AuthType selects how Barbican authenticates. + - "password": use username and password. + - "applicationCredential": use application credential ID and secret. + Defaults to "password". + enum: + - password + - applicationCredential + type: string password: description: BarbicanProviderPasswordRef defines a reference to a secret containing password for the Barbican provider. @@ -925,8 +1011,7 @@ spec: - secretRef type: object username: - description: BarbicanProviderUsernameRef defines a reference - to a secret containing username for the Barbican provider. + description: Username / Password authentication fields. maxProperties: 1 minProperties: 1 properties: @@ -960,12 +1045,26 @@ spec: type: string type: object value: + minLength: 1 type: string type: object - required: - - password - - username type: object + x-kubernetes-validations: + - message: password auth requires both username and password + rule: (has(self.authType) && self.authType == 'applicationCredential') + || (has(self.username) && has(self.password)) + - message: applicationCredential auth requires both applicationCredentialID + and applicationCredentialSecret + rule: self.authType != 'applicationCredential' || (has(self.applicationCredentialID) + && has(self.applicationCredentialSecret)) + - message: password auth should not include applicationCredential + fields + rule: (has(self.authType) && self.authType == 'applicationCredential') + || (!has(self.applicationCredentialID) && !has(self.applicationCredentialSecret)) + - message: applicationCredential auth should not include + password fields + rule: self.authType != 'applicationCredential' || (!has(self.username) + && !has(self.password)) authURL: type: string domainName: @@ -1668,6 +1767,65 @@ spec: - apiKeyRef - userRef type: object + azure: + description: Azure enables authentication to Conjur + via the authn-azure authenticator. + properties: + account: + description: Account is the Conjur organization + account name. + type: string + clientId: + description: |- + ClientID is the Azure managed identity client ID. Required for user-assigned + managed identities; omit for system-assigned identities. + type: string + hostId: + description: |- + HostID is the Conjur host mapped to the Azure managed identity + (e.g. "data/myapp/myhost"). + type: string + serviceAccountRef: + description: |- + ServiceAccountRef specifies the Kubernetes service account for which to request + a token via the TokenRequest API. That token is used as the Azure JWT for Conjur + authn-azure. If omitted, the token is fetched from the Azure IMDS endpoint instead. + properties: + audiences: + description: |- + Audience specifies the `aud` claim for the service account token + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) + items: + type: string + type: array + name: + description: The name of the ServiceAccount + resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + Namespace of the resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + serviceID: + description: ServiceID is the Conjur authn-azure + webservice identifier (e.g. "prod"). + type: string + required: + - account + - hostId + - serviceID + type: object cert: description: Cert enables certificate-based authentication using a client certificate and key. @@ -1747,6 +1905,189 @@ spec: - clientKeyRef - serviceID type: object + gcp: + description: GCP enables authentication to Conjur via + the authn-gcp authenticator. + properties: + account: + description: Account is the Conjur organization + account name. + type: string + hostId: + description: |- + HostID is the Conjur host mapped to the GCP service account + (e.g. "data/myapp/myhost"). + type: string + secretRef: + description: |- + SecretRef holds a reference to a Kubernetes Secret containing a pre-obtained + GCP identity token. If omitted, the token is fetched from the GCP Metadata + Service automatically (requires GKE Workload Identity or a GCE/GKE node). + properties: + jwt: + description: JWT is a reference to the Kubernetes + Secret key holding the GCP identity token. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource + being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - jwt + type: object + serviceID: + description: |- + ServiceID is the Conjur authn-gcp webservice identifier (e.g. "prod"). + Note: Conjur's authn-gcp authenticator does not include the service ID in the + authentication URL; this field is reserved for future use. + type: string + required: + - account + - hostId + type: object + iam: + description: IAM enables authentication to Conjur via + the authn-iam authenticator. + properties: + account: + description: Account is the Conjur organization + account name. + type: string + hostId: + description: |- + HostID is the Conjur host mapped to the AWS IAM role + (e.g. "data/myapp/123456789012/MyRole"). + type: string + insecure: + description: |- + Insecure allows authenticating to Conjur over plain HTTP. The AWS IAM authenticator + sends a signed request as a bearer credential, so this should only be enabled when the + connection is otherwise protected (e.g. a service mesh sidecar terminating TLS). + type: boolean + secretRef: + description: |- + SecretRef holds optional references to Kubernetes Secrets containing explicit + AWS credentials. If omitted, the default AWS SDK credential chain is used + (IRSA, instance metadata, environment variables, etc.). + properties: + accessKeyIDSecretRef: + description: A reference to a Secret key containing + the AWS Access Key ID. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource + being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + secretAccessKeySecretRef: + description: A reference to a Secret key containing + the AWS Secret Access Key. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource + being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + sessionTokenSecretRef: + description: |- + A reference to a Secret key containing the AWS Session Token. + Required only when using temporary credentials. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource + being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - accessKeyIDSecretRef + - secretAccessKeySecretRef + type: object + serviceID: + description: ServiceID is the Conjur authn-iam webservice + identifier (e.g. "prod"). + type: string + required: + - account + - hostId + - serviceID + type: object jwt: description: Jwt enables JWT authentication using Kubernetes service account tokens. @@ -1797,8 +2138,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -1966,8 +2307,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -2175,8 +2516,7 @@ spec: rule: has(self.auth) || has(self.authRef) - message: at most one of the fields in [auth authRef] may be set - rule: '[has(self.auth),has(self.authRef)].filter(x,x==true).size() - <= 1' + rule: (has(self.auth)?1:0)+(has(self.authRef)?1:0) <= 1 delinea: description: |- Delinea DevOps Secrets Vault @@ -2302,8 +2642,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -2629,8 +2969,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -2765,8 +3105,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -2809,7 +3149,7 @@ spec: type: object github: description: |- - Github configures this store to push GitHub Actions secrets using the GitHub API provider. + Github configures this store to push GitHub Actions or Dependabot secrets using the GitHub API provider. Note: This provider only supports write operations (PushSecret) and cannot fetch secrets from GitHub properties: appID: @@ -2880,6 +3220,15 @@ spec: description: repository will be used to fetch secrets from the Github repository within an organization type: string + secretType: + default: Actions + description: |- + secretType specifies which GitHub secret service to use. + Defaults to Actions for backwards compatibility. + enum: + - Actions + - Dependabot + type: string uploadURL: description: Upload URL for enterprise instances. Default to URL. @@ -2895,6 +3244,10 @@ spec: - installationID - organization type: object + x-kubernetes-validations: + - message: Dependabot secrets do not support environments + rule: self.secretType != 'Dependabot' || !has(self.environment) + || size(self.environment) == 0 gitlab: description: GitLab configures this store to sync secrets using GitLab Variables provider @@ -3963,7 +4316,6 @@ spec: type: boolean required: - authRef - - folderID type: object kubernetes: description: Kubernetes configures this store to sync secrets @@ -4047,8 +4399,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -4269,11 +4621,63 @@ spec: pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string type: object + workloadIdentity: + description: WorkloadIdentity defines configuration + for workload identity authentication to Nebius IAM. + properties: + iamServiceAccountID: + description: |- + IAMServiceAccountID is the Nebius IAM service account identifier that the + federated Kubernetes service account should impersonate during token exchange. + example: serviceaccount-e00example + minLength: 1 + pattern: ^serviceaccount-[a-z][a-z0-9]{2} + type: string + serviceAccountRef: + description: |- + ServiceAccountRef references a Kubernetes ServiceAccount used to request a + temporary JWT via the TokenRequest API. The JWT is then exchanged for a + Nebius IAM token using workload federation. + properties: + audiences: + description: |- + Audience specifies the `aud` claim for the service account token + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) + items: + type: string + type: array + name: + description: The name of the ServiceAccount + resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + Namespace of the resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + required: + - iamServiceAccountID + - serviceAccountRef + type: object type: object x-kubernetes-validations: - - message: either serviceAccountCredsSecretRef or tokenSecretRef - must be set - rule: has(self.serviceAccountCredsSecretRef) || has(self.tokenSecretRef) + - message: exactly one of serviceAccountCredsSecretRef, + tokenSecretRef, or workloadIdentity must be set + rule: '(has(self.serviceAccountCredsSecretRef) && has(self.serviceAccountCredsSecretRef.name) + && size(self.serviceAccountCredsSecretRef.name) > + 0 ? 1 : 0) + (has(self.tokenSecretRef) && has(self.tokenSecretRef.name) + && size(self.tokenSecretRef.name) > 0 ? 1 : 0) + (has(self.workloadIdentity) + ? 1 : 0) == 1' caProvider: description: The provider for the CA bundle to use to validate NebiusMysterybox server certificate. @@ -4587,6 +4991,12 @@ spec: Format: duration string (e.g., "5m", "1h", "30s") type: string type: object + environment: + description: |- + Environment defines the 1Password Environment ID to read variables from. + Environments are read-only: PushSecret, DeleteSecret, and SecretExists return an error when set. + Mutually exclusive with Vault. + type: string integrationInfo: description: |- IntegrationInfo specifies the name and version of the integration built using the 1Password Go SDK. @@ -4602,13 +5012,18 @@ spec: type: string type: object vault: - description: Vault defines the vault's name or uuid to access. - Do NOT add op:// prefix. This will be done automatically. + description: |- + Vault defines the vault's name or uuid to access. Do NOT add op:// prefix. This will be done automatically. + Mutually exclusive with Environment. type: string required: - auth - - vault type: object + x-kubernetes-validations: + - message: at most one of the fields in [vault environment] + may be set + rule: (has(self.vault)?1:0)+(has(self.environment)?1:0) + <= 1 openBao: description: OpenBao configures this store to sync secrets using the OpenBao provider. @@ -4705,8 +5120,99 @@ spec: x-kubernetes-validations: - message: exactly one of the fields in [roleId roleRef] must be set - rule: '[has(self.roleId),has(self.roleRef)].filter(x,x==true).size() - == 1' + rule: (has(self.roleId)?1:0)+(has(self.roleRef)?1:0) + == 1 + kubernetes: + description: |- + Kubernetes authenticates with OpenBao by passing a ServiceAccount + token to the [Kubernetes auth mechanism]. + + [Kubernetes auth mechanism]: https://openbao.org/docs/auth/kubernetes/ + properties: + path: + default: kubernetes + description: |- + Path where the Kubernetes authentication backend is mounted in OpenBao, e.g: + "kubernetes" + type: string + role: + description: |- + A required field containing the OpenBao Role to assume. A Role binds a + Kubernetes ServiceAccount with a set of OpenBao policies. + minLength: 1 + type: string + secretRef: + description: |- + Optional secret field containing a Kubernetes ServiceAccount JWT used + for authenticating with OpenBao. If a name is specified without a key, + `token` is the default. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource + being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + serviceAccountRef: + description: |- + Optional service account field containing the name of a Kubernetes ServiceAccount. + If the service account is specified, a token will be requested from the Kubernetes + TokenRequest API for authenticating with OpenBao. + Any configured audiences will be passed to the TokenRequest as-is. + properties: + audiences: + description: |- + Audience specifies the `aud` claim for the service account token + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) + items: + type: string + type: array + name: + description: The name of the ServiceAccount + resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + Namespace of the resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + required: + - path + - role + type: object + x-kubernetes-validations: + - message: exactly one of the fields in [serviceAccountRef + secretRef] must be set + rule: (has(self.serviceAccountRef)?1:0)+(has(self.secretRef)?1:0) + == 1 namespace: description: |- Name of the [OpenBao Namespace] to authenticate to. This can be different @@ -4801,9 +5307,9 @@ spec: type: object x-kubernetes-validations: - message: exactly one of the fields in [appRole tokenSecretRef - userPass] must be set - rule: '[has(self.appRole),has(self.tokenSecretRef),has(self.userPass)].filter(x,x==true).size() - == 1' + userPass kubernetes] must be set + rule: (has(self.appRole)?1:0)+(has(self.tokenSecretRef)?1:0)+(has(self.userPass)?1:0)+(has(self.kubernetes)?1:0) + == 1 caBundle: description: |- PEM encoded CA bundle used to validate the OpenBao server certificate. If @@ -4884,8 +5390,8 @@ spec: x-kubernetes-validations: - message: at most one of the fields in [caBundle caProvider] may be set - rule: '[has(self.caBundle),has(self.caProvider)].filter(x,x==true).size() - <= 1' + rule: (has(self.caBundle)?1:0)+(has(self.caProvider)?1:0) + <= 1 oracle: description: Oracle configures this store to sync secrets using Oracle Vault provider @@ -5003,8 +5509,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -5538,8 +6044,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -5741,6 +6247,11 @@ spec: - name - type type: object + disableSiteIDValidation: + description: |- + DisableSiteIDValidation permits a missing site ID for new secrets. + The provider sends 0 if no site ID is set. + type: boolean domain: description: Domain is the secret server domain. type: string @@ -5791,6 +6302,13 @@ spec: ServerURL URL to your secret server installation type: string + siteId: + description: |- + SiteID is the ID of the Secret Server site for new secrets. + PushSecret metadata can override this value for one secret. + The provider uses 1 if this field is not set. + minimum: 1 + type: integer token: description: |- Token is an access token used to authenticate to the secret server, @@ -6170,8 +6688,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -6219,8 +6737,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -6268,8 +6786,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -6444,8 +6962,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -6570,8 +7088,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -7651,8 +8169,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -7941,8 +8459,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -8281,8 +8799,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -8919,8 +9437,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -9356,8 +9874,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -9881,8 +10399,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -10290,8 +10808,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -10979,8 +11497,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -11155,8 +11673,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -11281,8 +11799,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array diff --git a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/sshkey.yaml b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/sshkey.yaml index e6e8807..e27444e 100644 --- a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/sshkey.yaml +++ b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/sshkey.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: sshkeys.generators.external-secrets.io diff --git a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/stssessiontoken.yaml b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/stssessiontoken.yaml index 28935e1..971cfd8 100644 --- a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/stssessiontoken.yaml +++ b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/stssessiontoken.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: stssessiontokens.generators.external-secrets.io @@ -62,8 +62,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array diff --git a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/uuid.yaml b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/uuid.yaml index 6d3a86c..2785076 100644 --- a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/uuid.yaml +++ b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/uuid.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: uuids.generators.external-secrets.io @@ -21,7 +21,7 @@ spec: - name: v1alpha1 schema: openAPIV3Schema: - description: UUID generates a version 1 UUID (e56657e3-764f-11ef-a397-65231a88c216). + description: UUID generates a version 4 UUID (21061816-abbd-40ef-8985-6db0fbcbc4c4). properties: apiVersion: description: |- diff --git a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/vaultdynamicsecret.yaml b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/vaultdynamicsecret.yaml index 9ea13a4..d219c6a 100644 --- a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/vaultdynamicsecret.yaml +++ b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/vaultdynamicsecret.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: vaultdynamicsecrets.generators.external-secrets.io @@ -298,8 +298,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -347,8 +347,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -394,8 +394,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -569,8 +569,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -695,8 +695,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array diff --git a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/webhook.yaml b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/webhook.yaml index e0b60fd..9db2360 100644 --- a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/webhook.yaml +++ b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/webhook.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: webhooks.generators.external-secrets.io diff --git a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/deployment.yaml b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/deployment.yaml index 007c4d9..bc32d99 100644 --- a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/deployment.yaml +++ b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/deployment.yaml @@ -5,8 +5,8 @@ metadata: app.kubernetes.io/instance: external-secrets app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: external-secrets - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 name: external-secrets namespace: syn-external-secrets-operator spec: @@ -22,8 +22,8 @@ spec: app.kubernetes.io/instance: external-secrets app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: external-secrets - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 spec: automountServiceAccountToken: true containers: diff --git a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/rbac.yaml b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/rbac.yaml index 1044b37..7123edd 100644 --- a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/rbac.yaml +++ b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/rbac.yaml @@ -5,8 +5,8 @@ metadata: app.kubernetes.io/instance: external-secrets app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: external-secrets - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 name: external-secrets-controller rules: - apiGroups: @@ -158,8 +158,8 @@ metadata: app.kubernetes.io/instance: external-secrets app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: external-secrets - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 rbac.authorization.k8s.io/aggregate-to-admin: 'true' rbac.authorization.k8s.io/aggregate-to-edit: 'true' rbac.authorization.k8s.io/aggregate-to-view: 'true' @@ -210,8 +210,8 @@ metadata: app.kubernetes.io/instance: external-secrets app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: external-secrets - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 rbac.authorization.k8s.io/aggregate-to-admin: 'true' rbac.authorization.k8s.io/aggregate-to-edit: 'true' name: external-secrets-edit @@ -265,8 +265,8 @@ metadata: app.kubernetes.io/instance: external-secrets app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: external-secrets - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 servicebinding.io/controller: 'true' name: external-secrets-servicebindings rules: @@ -287,8 +287,8 @@ metadata: app.kubernetes.io/instance: external-secrets app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: external-secrets - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 name: external-secrets-controller roleRef: apiGroup: rbac.authorization.k8s.io @@ -306,8 +306,8 @@ metadata: app.kubernetes.io/instance: external-secrets app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: external-secrets - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 name: external-secrets-leaderelection namespace: syn-external-secrets-operator rules: @@ -344,8 +344,8 @@ metadata: app.kubernetes.io/instance: external-secrets app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: external-secrets - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 name: external-secrets-leaderelection namespace: syn-external-secrets-operator roleRef: diff --git a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/service.yaml b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/service.yaml index 32c940f..a5129e3 100644 --- a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/service.yaml +++ b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/service.yaml @@ -5,8 +5,8 @@ metadata: app.kubernetes.io/instance: external-secrets app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: external-secrets - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 name: external-secrets-metrics namespace: syn-external-secrets-operator spec: diff --git a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/serviceaccount.yaml b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/serviceaccount.yaml index e342ad1..6a28cd1 100644 --- a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/serviceaccount.yaml +++ b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/serviceaccount.yaml @@ -5,7 +5,7 @@ metadata: app.kubernetes.io/instance: external-secrets app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: external-secrets - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 name: external-secrets namespace: syn-external-secrets-operator diff --git a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/servicemonitor.yaml b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/servicemonitor.yaml index ff633d6..d4ca37e 100644 --- a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/servicemonitor.yaml +++ b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/servicemonitor.yaml @@ -5,8 +5,8 @@ metadata: app.kubernetes.io/instance: external-secrets app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: external-secrets - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 name: external-secrets-metrics namespace: syn-external-secrets-operator spec: @@ -31,8 +31,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/metrics: webhook app.kubernetes.io/name: external-secrets-webhook - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 name: external-secrets-webhook-metrics namespace: syn-external-secrets-operator spec: @@ -58,8 +58,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/metrics: cert-controller app.kubernetes.io/name: external-secrets-cert-controller - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 name: external-secrets-cert-controller-metrics namespace: syn-external-secrets-operator spec: diff --git a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/validatingwebhook.yaml b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/validatingwebhook.yaml index 0d80e27..6ab13de 100644 --- a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/validatingwebhook.yaml +++ b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/validatingwebhook.yaml @@ -6,9 +6,9 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/metrics: webhook app.kubernetes.io/name: external-secrets-webhook - app.kubernetes.io/version: v2.8.0 + app.kubernetes.io/version: v2.14.0 external-secrets.io/component: webhook - helm.sh/chart: external-secrets-2.8.0 + helm.sh/chart: external-secrets-2.14.0 name: secretstore-validate webhooks: - admissionReviewVersions: @@ -68,9 +68,9 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/metrics: webhook app.kubernetes.io/name: external-secrets-webhook - app.kubernetes.io/version: v2.8.0 + app.kubernetes.io/version: v2.14.0 external-secrets.io/component: webhook - helm.sh/chart: external-secrets-2.8.0 + helm.sh/chart: external-secrets-2.14.0 name: externalsecret-validate webhooks: - admissionReviewVersions: diff --git a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/webhook-deployment.yaml b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/webhook-deployment.yaml index c38e40d..75849c5 100644 --- a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/webhook-deployment.yaml +++ b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/webhook-deployment.yaml @@ -6,8 +6,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/metrics: webhook app.kubernetes.io/name: external-secrets-webhook - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 name: external-secrets-webhook namespace: syn-external-secrets-operator spec: @@ -24,8 +24,8 @@ spec: app.kubernetes.io/managed-by: Helm app.kubernetes.io/metrics: webhook app.kubernetes.io/name: external-secrets-webhook - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 spec: automountServiceAccountToken: true containers: @@ -39,7 +39,7 @@ spec: - --healthz-addr=:8081 - --loglevel=info - --zap-time-encoding=epoch - image: ghcr.io/external-secrets/external-secrets:v2.8.0 + image: ghcr.io/external-secrets/external-secrets:v2.14.0 imagePullPolicy: IfNotPresent name: webhook ports: diff --git a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/webhook-secret.yaml b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/webhook-secret.yaml index b19ea22..faf5b6a 100644 --- a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/webhook-secret.yaml +++ b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/webhook-secret.yaml @@ -6,8 +6,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/metrics: webhook app.kubernetes.io/name: external-secrets-webhook - app.kubernetes.io/version: v2.8.0 + app.kubernetes.io/version: v2.14.0 external-secrets.io/component: webhook - helm.sh/chart: external-secrets-2.8.0 + helm.sh/chart: external-secrets-2.14.0 name: external-secrets-webhook namespace: syn-external-secrets-operator diff --git a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/webhook-service.yaml b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/webhook-service.yaml index b53261e..947eae2 100644 --- a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/webhook-service.yaml +++ b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/webhook-service.yaml @@ -6,9 +6,9 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/metrics: webhook app.kubernetes.io/name: external-secrets-webhook - app.kubernetes.io/version: v2.8.0 + app.kubernetes.io/version: v2.14.0 external-secrets.io/component: webhook - helm.sh/chart: external-secrets-2.8.0 + helm.sh/chart: external-secrets-2.14.0 name: external-secrets-webhook namespace: syn-external-secrets-operator spec: diff --git a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/webhook-serviceaccount.yaml b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/webhook-serviceaccount.yaml index e4e2d22..cb35ad6 100644 --- a/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/webhook-serviceaccount.yaml +++ b/tests/golden/defaults/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/webhook-serviceaccount.yaml @@ -6,7 +6,7 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/metrics: webhook app.kubernetes.io/name: external-secrets-webhook - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 name: external-secrets-webhook namespace: syn-external-secrets-operator diff --git a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/cert-controller-deployment.yaml b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/cert-controller-deployment.yaml index 935ecae..a228794 100644 --- a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/cert-controller-deployment.yaml +++ b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/cert-controller-deployment.yaml @@ -6,8 +6,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/metrics: cert-controller app.kubernetes.io/name: external-secrets-cert-controller - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 name: external-secrets-cert-controller namespace: syn-external-secrets-operator spec: @@ -24,8 +24,8 @@ spec: app.kubernetes.io/managed-by: Helm app.kubernetes.io/metrics: cert-controller app.kubernetes.io/name: external-secrets-cert-controller - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 spec: automountServiceAccountToken: true containers: @@ -41,7 +41,7 @@ spec: - --loglevel=info - --zap-time-encoding=epoch - --enable-partial-cache=true - image: ghcr.io/external-secrets/external-secrets:v2.8.0 + image: ghcr.io/external-secrets/external-secrets:v2.14.0 imagePullPolicy: IfNotPresent name: cert-controller ports: diff --git a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/cert-controller-rbac.yaml b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/cert-controller-rbac.yaml index 790da9e..0027513 100644 --- a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/cert-controller-rbac.yaml +++ b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/cert-controller-rbac.yaml @@ -6,8 +6,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/metrics: cert-controller app.kubernetes.io/name: external-secrets-cert-controller - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 name: external-secrets-cert-controller rules: - apiGroups: @@ -105,8 +105,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/metrics: cert-controller app.kubernetes.io/name: external-secrets-cert-controller - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 name: external-secrets-cert-controller roleRef: apiGroup: rbac.authorization.k8s.io diff --git a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/cert-controller-service.yaml b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/cert-controller-service.yaml index a2c715b..9297d44 100644 --- a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/cert-controller-service.yaml +++ b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/cert-controller-service.yaml @@ -6,8 +6,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/metrics: cert-controller app.kubernetes.io/name: external-secrets-cert-controller - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 name: external-secrets-cert-controller-metrics namespace: syn-external-secrets-operator spec: diff --git a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/cert-controller-serviceaccount.yaml b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/cert-controller-serviceaccount.yaml index c3f0373..7c40f4a 100644 --- a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/cert-controller-serviceaccount.yaml +++ b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/cert-controller-serviceaccount.yaml @@ -6,7 +6,7 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/metrics: cert-controller app.kubernetes.io/name: external-secrets-cert-controller - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 name: external-secrets-cert-controller namespace: syn-external-secrets-operator diff --git a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/acraccesstoken.yaml b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/acraccesstoken.yaml index 9c86191..6ecd164 100644 --- a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/acraccesstoken.yaml +++ b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/acraccesstoken.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: acraccesstokens.generators.external-secrets.io @@ -148,8 +148,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array diff --git a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/beyondtrustworkloadcredentialsdynamicsecret.yaml b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/beyondtrustworkloadcredentialsdynamicsecret.yaml index 246bd18..0b9d6d5 100644 --- a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/beyondtrustworkloadcredentialsdynamicsecret.yaml +++ b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/beyondtrustworkloadcredentialsdynamicsecret.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: beyondtrustworkloadcredentialsdynamicsecrets.generators.external-secrets.io diff --git a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/cloudsmithaccesstoken.yaml b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/cloudsmithaccesstoken.yaml index 468fb02..a906904 100644 --- a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/cloudsmithaccesstoken.yaml +++ b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/cloudsmithaccesstoken.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: cloudsmithaccesstokens.generators.external-secrets.io @@ -58,8 +58,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array diff --git a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/clusterexternalsecret.yaml b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/clusterexternalsecret.yaml index c634822..46a3164 100644 --- a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/clusterexternalsecret.yaml +++ b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/clusterexternalsecret.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: clusterexternalsecrets.external-secrets.io @@ -93,15 +93,15 @@ spec: which secret (version/property/..) to fetch. properties: conversionStrategy: - default: Default - description: Used to define a conversion Strategy + description: Used to define a conversion Strategy. + Defaults to Default when omitted. enum: - Default - Unicode type: string decodingStrategy: - default: None - description: Used to define a decoding Strategy + description: Used to define a decoding Strategy. Defaults + to None when omitted. enum: - Auto - Base64 @@ -113,7 +113,6 @@ spec: mandatory type: string metadataPolicy: - default: None description: Policy for fetching tags/labels from provider secrets, possible options are Fetch, None. Defaults to None @@ -239,15 +238,15 @@ spec: Note: Extract does not support sourceRef.Generator or sourceRef.GeneratorRef. properties: conversionStrategy: - default: Default - description: Used to define a conversion Strategy + description: Used to define a conversion Strategy. + Defaults to Default when omitted. enum: - Default - Unicode type: string decodingStrategy: - default: None - description: Used to define a decoding Strategy + description: Used to define a decoding Strategy. Defaults + to None when omitted. enum: - Auto - Base64 @@ -259,7 +258,6 @@ spec: mandatory type: string metadataPolicy: - default: None description: Policy for fetching tags/labels from provider secrets, possible options are Fetch, None. Defaults to None @@ -291,15 +289,15 @@ spec: Note: Find does not support sourceRef.Generator or sourceRef.GeneratorRef. properties: conversionStrategy: - default: Default - description: Used to define a conversion Strategy + description: Used to define a conversion Strategy. + Defaults to Default when omitted. enum: - Default - Unicode type: string decodingStrategy: - default: None - description: Used to define a decoding Strategy + description: Used to define a decoding Strategy. Defaults + to None when omitted. enum: - Auto - Base64 @@ -780,14 +778,15 @@ spec: default: Data description: |- Target specifies where to place the template result. - For Secret resources, common values are: "Data", "Annotations", "Labels". + For Secret resources the accepted values are empty, "Data", "Annotations" and "Labels"; + any other value is rejected because it would allow writes to privileged Secret fields. For custom resources (when spec.target.manifest is set), this supports nested paths like "spec.database.config" or "data". type: string valuesDecodingStrategy: - default: None - description: Used to define a decoding Strategy - for the rendered template values. + description: |- + Used to define a decoding Strategy for the rendered template values. + Defaults to None when omitted. enum: - Auto - Base64 diff --git a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/clustergenerator.yaml b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/clustergenerator.yaml index 096f92a..9bc27be 100644 --- a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/clustergenerator.yaml +++ b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/clustergenerator.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: clustergenerators.generators.external-secrets.io @@ -150,8 +150,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -396,8 +396,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -446,8 +446,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -650,8 +650,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -788,8 +788,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -826,7 +826,38 @@ spec: to generate a GitHub access token. properties: appID: + description: AppID is the GitHub App ID. Exactly one of + AppID or AppIDRef must be set. type: string + appIDRef: + description: AppIDRef references a secret key containing + the GitHub App ID. Exactly one of AppID or AppIDRef must + be set. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred + to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object auth: description: Auth configures how ESO authenticates with a Github instance. @@ -871,7 +902,38 @@ spec: - privateKey type: object installID: + description: InstallID is the GitHub App installation ID. + Exactly one of InstallID or InstallIDRef must be set. type: string + installIDRef: + description: |- + InstallIDRef references a secret key containing the GitHub App installation ID. Exactly one of InstallID or + InstallIDRef must be set. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred + to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object permissions: additionalProperties: type: string @@ -890,10 +952,17 @@ spec: to https://github.com/. type: string required: - - appID - auth - - installID type: object + x-kubernetes-validations: + - message: exactly one of the fields in [appID appIDRef] must + be set + rule: (has(self.appID)?1:0)+(has(self.appIDRef)?1:0) == + 1 + - message: exactly one of the fields in [installID installIDRef] + must be set + rule: (has(self.installID)?1:0)+(has(self.installIDRef)?1:0) + == 1 gitlabDeployTokenSpec: description: GitlabDeployTokenSpec defines the desired state to generate a GitLab deploy token. @@ -1191,6 +1260,11 @@ spec: default: false description: Set NoUpper to disable uppercase characters type: boolean + prefix: + description: |- + Prefix is prepended to every generated password after encoding. + It is not counted in length or subject to the character settings. + type: string secretKeys: description: |- SecretKeys defines the keys that will be populated with generated passwords. @@ -1199,6 +1273,11 @@ spec: type: string minItems: 1 type: array + suffix: + description: |- + Suffix is appended to every generated password after encoding. + It is not counted in length or subject to the character settings. + type: string symbolCharacters: description: |- SymbolCharacters specifies the special characters that should be used @@ -1229,8 +1308,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -1305,8 +1384,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -1714,8 +1793,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -1763,8 +1842,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -1812,8 +1891,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -1990,8 +2069,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -2116,8 +2195,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array diff --git a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/clusterpushsecret.yaml b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/clusterpushsecret.yaml index 2bc95a8..d5d8dec 100644 --- a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/clusterpushsecret.yaml +++ b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/clusterpushsecret.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: clusterpushsecrets.external-secrets.io @@ -654,14 +654,15 @@ spec: default: Data description: |- Target specifies where to place the template result. - For Secret resources, common values are: "Data", "Annotations", "Labels". + For Secret resources the accepted values are empty, "Data", "Annotations" and "Labels"; + any other value is rejected because it would allow writes to privileged Secret fields. For custom resources (when spec.target.manifest is set), this supports nested paths like "spec.database.config" or "data". type: string valuesDecodingStrategy: - default: None - description: Used to define a decoding Strategy for - the rendered template values. + description: |- + Used to define a decoding Strategy for the rendered template values. + Defaults to None when omitted. enum: - Auto - Base64 diff --git a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/clustersecretstore.yaml b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/clustersecretstore.yaml index 74f753d..6ed1c03 100644 --- a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/clustersecretstore.yaml +++ b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/clustersecretstore.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: clustersecretstores.external-secrets.io @@ -204,8 +204,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -332,8 +332,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -437,8 +437,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -839,8 +839,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -888,6 +888,92 @@ spec: description: BarbicanAuth contains the authentication information for Barbican. properties: + applicationCredentialID: + description: ID of the application credential used for + authentication. + maxProperties: 1 + minProperties: 1 + properties: + secretRef: + description: |- + SecretKeySelector is a reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource + being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + value: + minLength: 1 + type: string + type: object + applicationCredentialSecret: + description: BarbicanProviderAppCredSecretRef defines + a reference to an Application Credential Secret. + properties: + secretRef: + description: |- + SecretKeySelector is a reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource + being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - secretRef + type: object + authType: + default: password + description: |- + AuthType selects how Barbican authenticates. + - "password": use username and password. + - "applicationCredential": use application credential ID and secret. + Defaults to "password". + enum: + - password + - applicationCredential + type: string password: description: BarbicanProviderPasswordRef defines a reference to a secret containing password for the Barbican provider. @@ -925,8 +1011,7 @@ spec: - secretRef type: object username: - description: BarbicanProviderUsernameRef defines a reference - to a secret containing username for the Barbican provider. + description: Username / Password authentication fields. maxProperties: 1 minProperties: 1 properties: @@ -960,12 +1045,26 @@ spec: type: string type: object value: + minLength: 1 type: string type: object - required: - - password - - username type: object + x-kubernetes-validations: + - message: password auth requires both username and password + rule: (has(self.authType) && self.authType == 'applicationCredential') + || (has(self.username) && has(self.password)) + - message: applicationCredential auth requires both applicationCredentialID + and applicationCredentialSecret + rule: self.authType != 'applicationCredential' || (has(self.applicationCredentialID) + && has(self.applicationCredentialSecret)) + - message: password auth should not include applicationCredential + fields + rule: (has(self.authType) && self.authType == 'applicationCredential') + || (!has(self.applicationCredentialID) && !has(self.applicationCredentialSecret)) + - message: applicationCredential auth should not include + password fields + rule: self.authType != 'applicationCredential' || (!has(self.username) + && !has(self.password)) authURL: type: string domainName: @@ -1668,6 +1767,65 @@ spec: - apiKeyRef - userRef type: object + azure: + description: Azure enables authentication to Conjur + via the authn-azure authenticator. + properties: + account: + description: Account is the Conjur organization + account name. + type: string + clientId: + description: |- + ClientID is the Azure managed identity client ID. Required for user-assigned + managed identities; omit for system-assigned identities. + type: string + hostId: + description: |- + HostID is the Conjur host mapped to the Azure managed identity + (e.g. "data/myapp/myhost"). + type: string + serviceAccountRef: + description: |- + ServiceAccountRef specifies the Kubernetes service account for which to request + a token via the TokenRequest API. That token is used as the Azure JWT for Conjur + authn-azure. If omitted, the token is fetched from the Azure IMDS endpoint instead. + properties: + audiences: + description: |- + Audience specifies the `aud` claim for the service account token + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) + items: + type: string + type: array + name: + description: The name of the ServiceAccount + resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + Namespace of the resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + serviceID: + description: ServiceID is the Conjur authn-azure + webservice identifier (e.g. "prod"). + type: string + required: + - account + - hostId + - serviceID + type: object cert: description: Cert enables certificate-based authentication using a client certificate and key. @@ -1747,6 +1905,189 @@ spec: - clientKeyRef - serviceID type: object + gcp: + description: GCP enables authentication to Conjur via + the authn-gcp authenticator. + properties: + account: + description: Account is the Conjur organization + account name. + type: string + hostId: + description: |- + HostID is the Conjur host mapped to the GCP service account + (e.g. "data/myapp/myhost"). + type: string + secretRef: + description: |- + SecretRef holds a reference to a Kubernetes Secret containing a pre-obtained + GCP identity token. If omitted, the token is fetched from the GCP Metadata + Service automatically (requires GKE Workload Identity or a GCE/GKE node). + properties: + jwt: + description: JWT is a reference to the Kubernetes + Secret key holding the GCP identity token. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource + being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - jwt + type: object + serviceID: + description: |- + ServiceID is the Conjur authn-gcp webservice identifier (e.g. "prod"). + Note: Conjur's authn-gcp authenticator does not include the service ID in the + authentication URL; this field is reserved for future use. + type: string + required: + - account + - hostId + type: object + iam: + description: IAM enables authentication to Conjur via + the authn-iam authenticator. + properties: + account: + description: Account is the Conjur organization + account name. + type: string + hostId: + description: |- + HostID is the Conjur host mapped to the AWS IAM role + (e.g. "data/myapp/123456789012/MyRole"). + type: string + insecure: + description: |- + Insecure allows authenticating to Conjur over plain HTTP. The AWS IAM authenticator + sends a signed request as a bearer credential, so this should only be enabled when the + connection is otherwise protected (e.g. a service mesh sidecar terminating TLS). + type: boolean + secretRef: + description: |- + SecretRef holds optional references to Kubernetes Secrets containing explicit + AWS credentials. If omitted, the default AWS SDK credential chain is used + (IRSA, instance metadata, environment variables, etc.). + properties: + accessKeyIDSecretRef: + description: A reference to a Secret key containing + the AWS Access Key ID. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource + being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + secretAccessKeySecretRef: + description: A reference to a Secret key containing + the AWS Secret Access Key. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource + being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + sessionTokenSecretRef: + description: |- + A reference to a Secret key containing the AWS Session Token. + Required only when using temporary credentials. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource + being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - accessKeyIDSecretRef + - secretAccessKeySecretRef + type: object + serviceID: + description: ServiceID is the Conjur authn-iam webservice + identifier (e.g. "prod"). + type: string + required: + - account + - hostId + - serviceID + type: object jwt: description: Jwt enables JWT authentication using Kubernetes service account tokens. @@ -1797,8 +2138,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -1966,8 +2307,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -2175,8 +2516,7 @@ spec: rule: has(self.auth) || has(self.authRef) - message: at most one of the fields in [auth authRef] may be set - rule: '[has(self.auth),has(self.authRef)].filter(x,x==true).size() - <= 1' + rule: (has(self.auth)?1:0)+(has(self.authRef)?1:0) <= 1 delinea: description: |- Delinea DevOps Secrets Vault @@ -2302,8 +2642,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -2629,8 +2969,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -2765,8 +3105,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -2809,7 +3149,7 @@ spec: type: object github: description: |- - Github configures this store to push GitHub Actions secrets using the GitHub API provider. + Github configures this store to push GitHub Actions or Dependabot secrets using the GitHub API provider. Note: This provider only supports write operations (PushSecret) and cannot fetch secrets from GitHub properties: appID: @@ -2880,6 +3220,15 @@ spec: description: repository will be used to fetch secrets from the Github repository within an organization type: string + secretType: + default: Actions + description: |- + secretType specifies which GitHub secret service to use. + Defaults to Actions for backwards compatibility. + enum: + - Actions + - Dependabot + type: string uploadURL: description: Upload URL for enterprise instances. Default to URL. @@ -2895,6 +3244,10 @@ spec: - installationID - organization type: object + x-kubernetes-validations: + - message: Dependabot secrets do not support environments + rule: self.secretType != 'Dependabot' || !has(self.environment) + || size(self.environment) == 0 gitlab: description: GitLab configures this store to sync secrets using GitLab Variables provider @@ -3963,7 +4316,6 @@ spec: type: boolean required: - authRef - - folderID type: object kubernetes: description: Kubernetes configures this store to sync secrets @@ -4047,8 +4399,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -4269,11 +4621,63 @@ spec: pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string type: object + workloadIdentity: + description: WorkloadIdentity defines configuration + for workload identity authentication to Nebius IAM. + properties: + iamServiceAccountID: + description: |- + IAMServiceAccountID is the Nebius IAM service account identifier that the + federated Kubernetes service account should impersonate during token exchange. + example: serviceaccount-e00example + minLength: 1 + pattern: ^serviceaccount-[a-z][a-z0-9]{2} + type: string + serviceAccountRef: + description: |- + ServiceAccountRef references a Kubernetes ServiceAccount used to request a + temporary JWT via the TokenRequest API. The JWT is then exchanged for a + Nebius IAM token using workload federation. + properties: + audiences: + description: |- + Audience specifies the `aud` claim for the service account token + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) + items: + type: string + type: array + name: + description: The name of the ServiceAccount + resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + Namespace of the resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + required: + - iamServiceAccountID + - serviceAccountRef + type: object type: object x-kubernetes-validations: - - message: either serviceAccountCredsSecretRef or tokenSecretRef - must be set - rule: has(self.serviceAccountCredsSecretRef) || has(self.tokenSecretRef) + - message: exactly one of serviceAccountCredsSecretRef, + tokenSecretRef, or workloadIdentity must be set + rule: '(has(self.serviceAccountCredsSecretRef) && has(self.serviceAccountCredsSecretRef.name) + && size(self.serviceAccountCredsSecretRef.name) > + 0 ? 1 : 0) + (has(self.tokenSecretRef) && has(self.tokenSecretRef.name) + && size(self.tokenSecretRef.name) > 0 ? 1 : 0) + (has(self.workloadIdentity) + ? 1 : 0) == 1' caProvider: description: The provider for the CA bundle to use to validate NebiusMysterybox server certificate. @@ -4587,6 +4991,12 @@ spec: Format: duration string (e.g., "5m", "1h", "30s") type: string type: object + environment: + description: |- + Environment defines the 1Password Environment ID to read variables from. + Environments are read-only: PushSecret, DeleteSecret, and SecretExists return an error when set. + Mutually exclusive with Vault. + type: string integrationInfo: description: |- IntegrationInfo specifies the name and version of the integration built using the 1Password Go SDK. @@ -4602,13 +5012,18 @@ spec: type: string type: object vault: - description: Vault defines the vault's name or uuid to access. - Do NOT add op:// prefix. This will be done automatically. + description: |- + Vault defines the vault's name or uuid to access. Do NOT add op:// prefix. This will be done automatically. + Mutually exclusive with Environment. type: string required: - auth - - vault type: object + x-kubernetes-validations: + - message: at most one of the fields in [vault environment] + may be set + rule: (has(self.vault)?1:0)+(has(self.environment)?1:0) + <= 1 openBao: description: OpenBao configures this store to sync secrets using the OpenBao provider. @@ -4705,8 +5120,99 @@ spec: x-kubernetes-validations: - message: exactly one of the fields in [roleId roleRef] must be set - rule: '[has(self.roleId),has(self.roleRef)].filter(x,x==true).size() - == 1' + rule: (has(self.roleId)?1:0)+(has(self.roleRef)?1:0) + == 1 + kubernetes: + description: |- + Kubernetes authenticates with OpenBao by passing a ServiceAccount + token to the [Kubernetes auth mechanism]. + + [Kubernetes auth mechanism]: https://openbao.org/docs/auth/kubernetes/ + properties: + path: + default: kubernetes + description: |- + Path where the Kubernetes authentication backend is mounted in OpenBao, e.g: + "kubernetes" + type: string + role: + description: |- + A required field containing the OpenBao Role to assume. A Role binds a + Kubernetes ServiceAccount with a set of OpenBao policies. + minLength: 1 + type: string + secretRef: + description: |- + Optional secret field containing a Kubernetes ServiceAccount JWT used + for authenticating with OpenBao. If a name is specified without a key, + `token` is the default. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource + being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + serviceAccountRef: + description: |- + Optional service account field containing the name of a Kubernetes ServiceAccount. + If the service account is specified, a token will be requested from the Kubernetes + TokenRequest API for authenticating with OpenBao. + Any configured audiences will be passed to the TokenRequest as-is. + properties: + audiences: + description: |- + Audience specifies the `aud` claim for the service account token + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) + items: + type: string + type: array + name: + description: The name of the ServiceAccount + resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + Namespace of the resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + required: + - path + - role + type: object + x-kubernetes-validations: + - message: exactly one of the fields in [serviceAccountRef + secretRef] must be set + rule: (has(self.serviceAccountRef)?1:0)+(has(self.secretRef)?1:0) + == 1 namespace: description: |- Name of the [OpenBao Namespace] to authenticate to. This can be different @@ -4801,9 +5307,9 @@ spec: type: object x-kubernetes-validations: - message: exactly one of the fields in [appRole tokenSecretRef - userPass] must be set - rule: '[has(self.appRole),has(self.tokenSecretRef),has(self.userPass)].filter(x,x==true).size() - == 1' + userPass kubernetes] must be set + rule: (has(self.appRole)?1:0)+(has(self.tokenSecretRef)?1:0)+(has(self.userPass)?1:0)+(has(self.kubernetes)?1:0) + == 1 caBundle: description: |- PEM encoded CA bundle used to validate the OpenBao server certificate. If @@ -4884,8 +5390,8 @@ spec: x-kubernetes-validations: - message: at most one of the fields in [caBundle caProvider] may be set - rule: '[has(self.caBundle),has(self.caProvider)].filter(x,x==true).size() - <= 1' + rule: (has(self.caBundle)?1:0)+(has(self.caProvider)?1:0) + <= 1 oracle: description: Oracle configures this store to sync secrets using Oracle Vault provider @@ -5003,8 +5509,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -5538,8 +6044,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -5741,6 +6247,11 @@ spec: - name - type type: object + disableSiteIDValidation: + description: |- + DisableSiteIDValidation permits a missing site ID for new secrets. + The provider sends 0 if no site ID is set. + type: boolean domain: description: Domain is the secret server domain. type: string @@ -5791,6 +6302,13 @@ spec: ServerURL URL to your secret server installation type: string + siteId: + description: |- + SiteID is the ID of the Secret Server site for new secrets. + PushSecret metadata can override this value for one secret. + The provider uses 1 if this field is not set. + minimum: 1 + type: integer token: description: |- Token is an access token used to authenticate to the secret server, @@ -6170,8 +6688,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -6219,8 +6737,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -6268,8 +6786,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -6444,8 +6962,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -6570,8 +7088,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -7651,8 +8169,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -7941,8 +8459,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -8281,8 +8799,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -8919,8 +9437,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -9356,8 +9874,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -9881,8 +10399,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -10290,8 +10808,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -10979,8 +11497,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -11155,8 +11673,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -11281,8 +11799,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array diff --git a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/ecrauthorizationtoken.yaml b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/ecrauthorizationtoken.yaml index 74f6b49..2fdd439 100644 --- a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/ecrauthorizationtoken.yaml +++ b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/ecrauthorizationtoken.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: ecrauthorizationtokens.generators.external-secrets.io @@ -63,8 +63,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array diff --git a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/externalsecret.yaml b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/externalsecret.yaml index e84ec95..cc88c53 100644 --- a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/externalsecret.yaml +++ b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/externalsecret.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: externalsecrets.external-secrets.io @@ -79,15 +79,15 @@ spec: which secret (version/property/..) to fetch. properties: conversionStrategy: - default: Default - description: Used to define a conversion Strategy + description: Used to define a conversion Strategy. Defaults + to Default when omitted. enum: - Default - Unicode type: string decodingStrategy: - default: None - description: Used to define a decoding Strategy + description: Used to define a decoding Strategy. Defaults + to None when omitted. enum: - Auto - Base64 @@ -98,7 +98,6 @@ spec: description: Key is the key used in the Provider, mandatory type: string metadataPolicy: - default: None description: Policy for fetching tags/labels from provider secrets, possible options are Fetch, None. Defaults to None @@ -222,15 +221,15 @@ spec: Note: Extract does not support sourceRef.Generator or sourceRef.GeneratorRef. properties: conversionStrategy: - default: Default - description: Used to define a conversion Strategy + description: Used to define a conversion Strategy. Defaults + to Default when omitted. enum: - Default - Unicode type: string decodingStrategy: - default: None - description: Used to define a decoding Strategy + description: Used to define a decoding Strategy. Defaults + to None when omitted. enum: - Auto - Base64 @@ -241,7 +240,6 @@ spec: description: Key is the key used in the Provider, mandatory type: string metadataPolicy: - default: None description: Policy for fetching tags/labels from provider secrets, possible options are Fetch, None. Defaults to None @@ -273,15 +271,15 @@ spec: Note: Find does not support sourceRef.Generator or sourceRef.GeneratorRef. properties: conversionStrategy: - default: Default - description: Used to define a conversion Strategy + description: Used to define a conversion Strategy. Defaults + to Default when omitted. enum: - Default - Unicode type: string decodingStrategy: - default: None - description: Used to define a decoding Strategy + description: Used to define a decoding Strategy. Defaults + to None when omitted. enum: - Auto - Base64 @@ -755,14 +753,15 @@ spec: default: Data description: |- Target specifies where to place the template result. - For Secret resources, common values are: "Data", "Annotations", "Labels". + For Secret resources the accepted values are empty, "Data", "Annotations" and "Labels"; + any other value is rejected because it would allow writes to privileged Secret fields. For custom resources (when spec.target.manifest is set), this supports nested paths like "spec.database.config" or "data". type: string valuesDecodingStrategy: - default: None - description: Used to define a decoding Strategy for - the rendered template values. + description: |- + Used to define a decoding Strategy for the rendered template values. + Defaults to None when omitted. enum: - Auto - Base64 diff --git a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/fake.yaml b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/fake.yaml index 4859cf5..e7f2ce6 100644 --- a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/fake.yaml +++ b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/fake.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: fakes.generators.external-secrets.io diff --git a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/gcraccesstoken.yaml b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/gcraccesstoken.yaml index 6750ae0..42f47b7 100644 --- a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/gcraccesstoken.yaml +++ b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/gcraccesstoken.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: gcraccesstokens.generators.external-secrets.io @@ -98,8 +98,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -233,8 +233,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array diff --git a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/generatorstate.yaml b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/generatorstate.yaml index f2e2cb7..aa6aa0a 100644 --- a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/generatorstate.yaml +++ b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/generatorstate.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: generatorstates.generators.external-secrets.io diff --git a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/githubaccesstoken.yaml b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/githubaccesstoken.yaml index 5837754..ade70a3 100644 --- a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/githubaccesstoken.yaml +++ b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/githubaccesstoken.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: githubaccesstokens.generators.external-secrets.io @@ -45,7 +45,37 @@ spec: a GitHub access token. properties: appID: + description: AppID is the GitHub App ID. Exactly one of AppID or + AppIDRef must be set. type: string + appIDRef: + description: AppIDRef references a secret key containing the GitHub + App ID. Exactly one of AppID or AppIDRef must be set. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred + to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object auth: description: Auth configures how ESO authenticates with a Github instance. @@ -90,7 +120,38 @@ spec: - privateKey type: object installID: + description: InstallID is the GitHub App installation ID. Exactly + one of InstallID or InstallIDRef must be set. type: string + installIDRef: + description: |- + InstallIDRef references a secret key containing the GitHub App installation ID. Exactly one of InstallID or + InstallIDRef must be set. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred + to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object permissions: additionalProperties: type: string @@ -109,10 +170,15 @@ spec: https://github.com/. type: string required: - - appID - auth - - installID type: object + x-kubernetes-validations: + - message: exactly one of the fields in [appID appIDRef] must be set + rule: (has(self.appID)?1:0)+(has(self.appIDRef)?1:0) == 1 + - message: exactly one of the fields in [installID installIDRef] must + be set + rule: (has(self.installID)?1:0)+(has(self.installIDRef)?1:0) == + 1 type: object served: true storage: true diff --git a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/gitlabdeploytoken.yaml b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/gitlabdeploytoken.yaml index 4ec9b10..a35383f 100644 --- a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/gitlabdeploytoken.yaml +++ b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/gitlabdeploytoken.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: gitlabdeploytokens.generators.external-secrets.io diff --git a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/grafana.yaml b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/grafana.yaml index b477af1..7791a6e 100644 --- a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/grafana.yaml +++ b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/grafana.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: grafanas.generators.external-secrets.io diff --git a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/mfa.yaml b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/mfa.yaml index 6c8887f..f07814f 100644 --- a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/mfa.yaml +++ b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/mfa.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: mfas.generators.external-secrets.io diff --git a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/password.yaml b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/password.yaml index b7c9e20..84553a1 100644 --- a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/password.yaml +++ b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/password.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: passwords.generators.external-secrets.io @@ -82,6 +82,11 @@ spec: default: false description: Set NoUpper to disable uppercase characters type: boolean + prefix: + description: |- + Prefix is prepended to every generated password after encoding. + It is not counted in length or subject to the character settings. + type: string secretKeys: description: |- SecretKeys defines the keys that will be populated with generated passwords. @@ -90,6 +95,11 @@ spec: type: string minItems: 1 type: array + suffix: + description: |- + Suffix is appended to every generated password after encoding. + It is not counted in length or subject to the character settings. + type: string symbolCharacters: description: |- SymbolCharacters specifies the special characters that should be used diff --git a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/pushsecret.yaml b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/pushsecret.yaml index ab1df8a..bfa45aa 100644 --- a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/pushsecret.yaml +++ b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/pushsecret.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: pushsecrets.external-secrets.io @@ -576,14 +576,15 @@ spec: default: Data description: |- Target specifies where to place the template result. - For Secret resources, common values are: "Data", "Annotations", "Labels". + For Secret resources the accepted values are empty, "Data", "Annotations" and "Labels"; + any other value is rejected because it would allow writes to privileged Secret fields. For custom resources (when spec.target.manifest is set), this supports nested paths like "spec.database.config" or "data". type: string valuesDecodingStrategy: - default: None - description: Used to define a decoding Strategy for the - rendered template values. + description: |- + Used to define a decoding Strategy for the rendered template values. + Defaults to None when omitted. enum: - Auto - Base64 diff --git a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/quayaccesstoken.yaml b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/quayaccesstoken.yaml index d0ccb40..7aff3c5 100644 --- a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/quayaccesstoken.yaml +++ b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/quayaccesstoken.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: quayaccesstokens.generators.external-secrets.io @@ -54,8 +54,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array diff --git a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/secretstore.yaml b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/secretstore.yaml index 29098d1..c20d905 100644 --- a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/secretstore.yaml +++ b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/secretstore.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: secretstores.external-secrets.io @@ -204,8 +204,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -332,8 +332,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -437,8 +437,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -839,8 +839,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -888,6 +888,92 @@ spec: description: BarbicanAuth contains the authentication information for Barbican. properties: + applicationCredentialID: + description: ID of the application credential used for + authentication. + maxProperties: 1 + minProperties: 1 + properties: + secretRef: + description: |- + SecretKeySelector is a reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource + being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + value: + minLength: 1 + type: string + type: object + applicationCredentialSecret: + description: BarbicanProviderAppCredSecretRef defines + a reference to an Application Credential Secret. + properties: + secretRef: + description: |- + SecretKeySelector is a reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource + being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - secretRef + type: object + authType: + default: password + description: |- + AuthType selects how Barbican authenticates. + - "password": use username and password. + - "applicationCredential": use application credential ID and secret. + Defaults to "password". + enum: + - password + - applicationCredential + type: string password: description: BarbicanProviderPasswordRef defines a reference to a secret containing password for the Barbican provider. @@ -925,8 +1011,7 @@ spec: - secretRef type: object username: - description: BarbicanProviderUsernameRef defines a reference - to a secret containing username for the Barbican provider. + description: Username / Password authentication fields. maxProperties: 1 minProperties: 1 properties: @@ -960,12 +1045,26 @@ spec: type: string type: object value: + minLength: 1 type: string type: object - required: - - password - - username type: object + x-kubernetes-validations: + - message: password auth requires both username and password + rule: (has(self.authType) && self.authType == 'applicationCredential') + || (has(self.username) && has(self.password)) + - message: applicationCredential auth requires both applicationCredentialID + and applicationCredentialSecret + rule: self.authType != 'applicationCredential' || (has(self.applicationCredentialID) + && has(self.applicationCredentialSecret)) + - message: password auth should not include applicationCredential + fields + rule: (has(self.authType) && self.authType == 'applicationCredential') + || (!has(self.applicationCredentialID) && !has(self.applicationCredentialSecret)) + - message: applicationCredential auth should not include + password fields + rule: self.authType != 'applicationCredential' || (!has(self.username) + && !has(self.password)) authURL: type: string domainName: @@ -1668,6 +1767,65 @@ spec: - apiKeyRef - userRef type: object + azure: + description: Azure enables authentication to Conjur + via the authn-azure authenticator. + properties: + account: + description: Account is the Conjur organization + account name. + type: string + clientId: + description: |- + ClientID is the Azure managed identity client ID. Required for user-assigned + managed identities; omit for system-assigned identities. + type: string + hostId: + description: |- + HostID is the Conjur host mapped to the Azure managed identity + (e.g. "data/myapp/myhost"). + type: string + serviceAccountRef: + description: |- + ServiceAccountRef specifies the Kubernetes service account for which to request + a token via the TokenRequest API. That token is used as the Azure JWT for Conjur + authn-azure. If omitted, the token is fetched from the Azure IMDS endpoint instead. + properties: + audiences: + description: |- + Audience specifies the `aud` claim for the service account token + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) + items: + type: string + type: array + name: + description: The name of the ServiceAccount + resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + Namespace of the resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + serviceID: + description: ServiceID is the Conjur authn-azure + webservice identifier (e.g. "prod"). + type: string + required: + - account + - hostId + - serviceID + type: object cert: description: Cert enables certificate-based authentication using a client certificate and key. @@ -1747,6 +1905,189 @@ spec: - clientKeyRef - serviceID type: object + gcp: + description: GCP enables authentication to Conjur via + the authn-gcp authenticator. + properties: + account: + description: Account is the Conjur organization + account name. + type: string + hostId: + description: |- + HostID is the Conjur host mapped to the GCP service account + (e.g. "data/myapp/myhost"). + type: string + secretRef: + description: |- + SecretRef holds a reference to a Kubernetes Secret containing a pre-obtained + GCP identity token. If omitted, the token is fetched from the GCP Metadata + Service automatically (requires GKE Workload Identity or a GCE/GKE node). + properties: + jwt: + description: JWT is a reference to the Kubernetes + Secret key holding the GCP identity token. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource + being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - jwt + type: object + serviceID: + description: |- + ServiceID is the Conjur authn-gcp webservice identifier (e.g. "prod"). + Note: Conjur's authn-gcp authenticator does not include the service ID in the + authentication URL; this field is reserved for future use. + type: string + required: + - account + - hostId + type: object + iam: + description: IAM enables authentication to Conjur via + the authn-iam authenticator. + properties: + account: + description: Account is the Conjur organization + account name. + type: string + hostId: + description: |- + HostID is the Conjur host mapped to the AWS IAM role + (e.g. "data/myapp/123456789012/MyRole"). + type: string + insecure: + description: |- + Insecure allows authenticating to Conjur over plain HTTP. The AWS IAM authenticator + sends a signed request as a bearer credential, so this should only be enabled when the + connection is otherwise protected (e.g. a service mesh sidecar terminating TLS). + type: boolean + secretRef: + description: |- + SecretRef holds optional references to Kubernetes Secrets containing explicit + AWS credentials. If omitted, the default AWS SDK credential chain is used + (IRSA, instance metadata, environment variables, etc.). + properties: + accessKeyIDSecretRef: + description: A reference to a Secret key containing + the AWS Access Key ID. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource + being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + secretAccessKeySecretRef: + description: A reference to a Secret key containing + the AWS Secret Access Key. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource + being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + sessionTokenSecretRef: + description: |- + A reference to a Secret key containing the AWS Session Token. + Required only when using temporary credentials. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource + being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - accessKeyIDSecretRef + - secretAccessKeySecretRef + type: object + serviceID: + description: ServiceID is the Conjur authn-iam webservice + identifier (e.g. "prod"). + type: string + required: + - account + - hostId + - serviceID + type: object jwt: description: Jwt enables JWT authentication using Kubernetes service account tokens. @@ -1797,8 +2138,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -1966,8 +2307,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -2175,8 +2516,7 @@ spec: rule: has(self.auth) || has(self.authRef) - message: at most one of the fields in [auth authRef] may be set - rule: '[has(self.auth),has(self.authRef)].filter(x,x==true).size() - <= 1' + rule: (has(self.auth)?1:0)+(has(self.authRef)?1:0) <= 1 delinea: description: |- Delinea DevOps Secrets Vault @@ -2302,8 +2642,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -2629,8 +2969,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -2765,8 +3105,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -2809,7 +3149,7 @@ spec: type: object github: description: |- - Github configures this store to push GitHub Actions secrets using the GitHub API provider. + Github configures this store to push GitHub Actions or Dependabot secrets using the GitHub API provider. Note: This provider only supports write operations (PushSecret) and cannot fetch secrets from GitHub properties: appID: @@ -2880,6 +3220,15 @@ spec: description: repository will be used to fetch secrets from the Github repository within an organization type: string + secretType: + default: Actions + description: |- + secretType specifies which GitHub secret service to use. + Defaults to Actions for backwards compatibility. + enum: + - Actions + - Dependabot + type: string uploadURL: description: Upload URL for enterprise instances. Default to URL. @@ -2895,6 +3244,10 @@ spec: - installationID - organization type: object + x-kubernetes-validations: + - message: Dependabot secrets do not support environments + rule: self.secretType != 'Dependabot' || !has(self.environment) + || size(self.environment) == 0 gitlab: description: GitLab configures this store to sync secrets using GitLab Variables provider @@ -3963,7 +4316,6 @@ spec: type: boolean required: - authRef - - folderID type: object kubernetes: description: Kubernetes configures this store to sync secrets @@ -4047,8 +4399,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -4269,11 +4621,63 @@ spec: pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string type: object + workloadIdentity: + description: WorkloadIdentity defines configuration + for workload identity authentication to Nebius IAM. + properties: + iamServiceAccountID: + description: |- + IAMServiceAccountID is the Nebius IAM service account identifier that the + federated Kubernetes service account should impersonate during token exchange. + example: serviceaccount-e00example + minLength: 1 + pattern: ^serviceaccount-[a-z][a-z0-9]{2} + type: string + serviceAccountRef: + description: |- + ServiceAccountRef references a Kubernetes ServiceAccount used to request a + temporary JWT via the TokenRequest API. The JWT is then exchanged for a + Nebius IAM token using workload federation. + properties: + audiences: + description: |- + Audience specifies the `aud` claim for the service account token + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) + items: + type: string + type: array + name: + description: The name of the ServiceAccount + resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + Namespace of the resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + required: + - iamServiceAccountID + - serviceAccountRef + type: object type: object x-kubernetes-validations: - - message: either serviceAccountCredsSecretRef or tokenSecretRef - must be set - rule: has(self.serviceAccountCredsSecretRef) || has(self.tokenSecretRef) + - message: exactly one of serviceAccountCredsSecretRef, + tokenSecretRef, or workloadIdentity must be set + rule: '(has(self.serviceAccountCredsSecretRef) && has(self.serviceAccountCredsSecretRef.name) + && size(self.serviceAccountCredsSecretRef.name) > + 0 ? 1 : 0) + (has(self.tokenSecretRef) && has(self.tokenSecretRef.name) + && size(self.tokenSecretRef.name) > 0 ? 1 : 0) + (has(self.workloadIdentity) + ? 1 : 0) == 1' caProvider: description: The provider for the CA bundle to use to validate NebiusMysterybox server certificate. @@ -4587,6 +4991,12 @@ spec: Format: duration string (e.g., "5m", "1h", "30s") type: string type: object + environment: + description: |- + Environment defines the 1Password Environment ID to read variables from. + Environments are read-only: PushSecret, DeleteSecret, and SecretExists return an error when set. + Mutually exclusive with Vault. + type: string integrationInfo: description: |- IntegrationInfo specifies the name and version of the integration built using the 1Password Go SDK. @@ -4602,13 +5012,18 @@ spec: type: string type: object vault: - description: Vault defines the vault's name or uuid to access. - Do NOT add op:// prefix. This will be done automatically. + description: |- + Vault defines the vault's name or uuid to access. Do NOT add op:// prefix. This will be done automatically. + Mutually exclusive with Environment. type: string required: - auth - - vault type: object + x-kubernetes-validations: + - message: at most one of the fields in [vault environment] + may be set + rule: (has(self.vault)?1:0)+(has(self.environment)?1:0) + <= 1 openBao: description: OpenBao configures this store to sync secrets using the OpenBao provider. @@ -4705,8 +5120,99 @@ spec: x-kubernetes-validations: - message: exactly one of the fields in [roleId roleRef] must be set - rule: '[has(self.roleId),has(self.roleRef)].filter(x,x==true).size() - == 1' + rule: (has(self.roleId)?1:0)+(has(self.roleRef)?1:0) + == 1 + kubernetes: + description: |- + Kubernetes authenticates with OpenBao by passing a ServiceAccount + token to the [Kubernetes auth mechanism]. + + [Kubernetes auth mechanism]: https://openbao.org/docs/auth/kubernetes/ + properties: + path: + default: kubernetes + description: |- + Path where the Kubernetes authentication backend is mounted in OpenBao, e.g: + "kubernetes" + type: string + role: + description: |- + A required field containing the OpenBao Role to assume. A Role binds a + Kubernetes ServiceAccount with a set of OpenBao policies. + minLength: 1 + type: string + secretRef: + description: |- + Optional secret field containing a Kubernetes ServiceAccount JWT used + for authenticating with OpenBao. If a name is specified without a key, + `token` is the default. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource + being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + serviceAccountRef: + description: |- + Optional service account field containing the name of a Kubernetes ServiceAccount. + If the service account is specified, a token will be requested from the Kubernetes + TokenRequest API for authenticating with OpenBao. + Any configured audiences will be passed to the TokenRequest as-is. + properties: + audiences: + description: |- + Audience specifies the `aud` claim for the service account token + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) + items: + type: string + type: array + name: + description: The name of the ServiceAccount + resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + Namespace of the resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + required: + - path + - role + type: object + x-kubernetes-validations: + - message: exactly one of the fields in [serviceAccountRef + secretRef] must be set + rule: (has(self.serviceAccountRef)?1:0)+(has(self.secretRef)?1:0) + == 1 namespace: description: |- Name of the [OpenBao Namespace] to authenticate to. This can be different @@ -4801,9 +5307,9 @@ spec: type: object x-kubernetes-validations: - message: exactly one of the fields in [appRole tokenSecretRef - userPass] must be set - rule: '[has(self.appRole),has(self.tokenSecretRef),has(self.userPass)].filter(x,x==true).size() - == 1' + userPass kubernetes] must be set + rule: (has(self.appRole)?1:0)+(has(self.tokenSecretRef)?1:0)+(has(self.userPass)?1:0)+(has(self.kubernetes)?1:0) + == 1 caBundle: description: |- PEM encoded CA bundle used to validate the OpenBao server certificate. If @@ -4884,8 +5390,8 @@ spec: x-kubernetes-validations: - message: at most one of the fields in [caBundle caProvider] may be set - rule: '[has(self.caBundle),has(self.caProvider)].filter(x,x==true).size() - <= 1' + rule: (has(self.caBundle)?1:0)+(has(self.caProvider)?1:0) + <= 1 oracle: description: Oracle configures this store to sync secrets using Oracle Vault provider @@ -5003,8 +5509,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -5538,8 +6044,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -5741,6 +6247,11 @@ spec: - name - type type: object + disableSiteIDValidation: + description: |- + DisableSiteIDValidation permits a missing site ID for new secrets. + The provider sends 0 if no site ID is set. + type: boolean domain: description: Domain is the secret server domain. type: string @@ -5791,6 +6302,13 @@ spec: ServerURL URL to your secret server installation type: string + siteId: + description: |- + SiteID is the ID of the Secret Server site for new secrets. + PushSecret metadata can override this value for one secret. + The provider uses 1 if this field is not set. + minimum: 1 + type: integer token: description: |- Token is an access token used to authenticate to the secret server, @@ -6170,8 +6688,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -6219,8 +6737,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -6268,8 +6786,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -6444,8 +6962,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -6570,8 +7088,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -7651,8 +8169,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -7941,8 +8459,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -8281,8 +8799,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -8919,8 +9437,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -9356,8 +9874,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -9881,8 +10399,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -10290,8 +10808,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -10979,8 +11497,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -11155,8 +11673,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -11281,8 +11799,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array diff --git a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/sshkey.yaml b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/sshkey.yaml index e6e8807..e27444e 100644 --- a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/sshkey.yaml +++ b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/sshkey.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: sshkeys.generators.external-secrets.io diff --git a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/stssessiontoken.yaml b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/stssessiontoken.yaml index 28935e1..971cfd8 100644 --- a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/stssessiontoken.yaml +++ b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/stssessiontoken.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: stssessiontokens.generators.external-secrets.io @@ -62,8 +62,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array diff --git a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/uuid.yaml b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/uuid.yaml index 6d3a86c..2785076 100644 --- a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/uuid.yaml +++ b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/uuid.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: uuids.generators.external-secrets.io @@ -21,7 +21,7 @@ spec: - name: v1alpha1 schema: openAPIV3Schema: - description: UUID generates a version 1 UUID (e56657e3-764f-11ef-a397-65231a88c216). + description: UUID generates a version 4 UUID (21061816-abbd-40ef-8985-6db0fbcbc4c4). properties: apiVersion: description: |- diff --git a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/vaultdynamicsecret.yaml b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/vaultdynamicsecret.yaml index 9ea13a4..d219c6a 100644 --- a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/vaultdynamicsecret.yaml +++ b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/vaultdynamicsecret.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: vaultdynamicsecrets.generators.external-secrets.io @@ -298,8 +298,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -347,8 +347,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -394,8 +394,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -569,8 +569,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array @@ -695,8 +695,8 @@ spec: audiences: description: |- Audience specifies the `aud` claim for the service account token - If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity - then this audiences will be appended to the list + Some providers automatically extend the audience field based on well-known annotations for workload + identity (e.g. IRSA or GCP Workload Identity) items: type: string type: array diff --git a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/webhook.yaml b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/webhook.yaml index e0b60fd..9db2360 100644 --- a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/webhook.yaml +++ b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/crds/webhook.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.23.0 labels: external-secrets.io/component: controller name: webhooks.generators.external-secrets.io diff --git a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/deployment.yaml b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/deployment.yaml index d652abe..13e11a5 100644 --- a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/deployment.yaml +++ b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/deployment.yaml @@ -5,8 +5,8 @@ metadata: app.kubernetes.io/instance: external-secrets app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: external-secrets - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 name: external-secrets namespace: syn-external-secrets-operator spec: @@ -22,8 +22,8 @@ spec: app.kubernetes.io/instance: external-secrets app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: external-secrets - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 spec: automountServiceAccountToken: true containers: diff --git a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/rbac.yaml b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/rbac.yaml index 1044b37..7123edd 100644 --- a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/rbac.yaml +++ b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/rbac.yaml @@ -5,8 +5,8 @@ metadata: app.kubernetes.io/instance: external-secrets app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: external-secrets - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 name: external-secrets-controller rules: - apiGroups: @@ -158,8 +158,8 @@ metadata: app.kubernetes.io/instance: external-secrets app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: external-secrets - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 rbac.authorization.k8s.io/aggregate-to-admin: 'true' rbac.authorization.k8s.io/aggregate-to-edit: 'true' rbac.authorization.k8s.io/aggregate-to-view: 'true' @@ -210,8 +210,8 @@ metadata: app.kubernetes.io/instance: external-secrets app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: external-secrets - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 rbac.authorization.k8s.io/aggregate-to-admin: 'true' rbac.authorization.k8s.io/aggregate-to-edit: 'true' name: external-secrets-edit @@ -265,8 +265,8 @@ metadata: app.kubernetes.io/instance: external-secrets app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: external-secrets - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 servicebinding.io/controller: 'true' name: external-secrets-servicebindings rules: @@ -287,8 +287,8 @@ metadata: app.kubernetes.io/instance: external-secrets app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: external-secrets - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 name: external-secrets-controller roleRef: apiGroup: rbac.authorization.k8s.io @@ -306,8 +306,8 @@ metadata: app.kubernetes.io/instance: external-secrets app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: external-secrets - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 name: external-secrets-leaderelection namespace: syn-external-secrets-operator rules: @@ -344,8 +344,8 @@ metadata: app.kubernetes.io/instance: external-secrets app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: external-secrets - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 name: external-secrets-leaderelection namespace: syn-external-secrets-operator roleRef: diff --git a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/service.yaml b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/service.yaml index 32c940f..a5129e3 100644 --- a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/service.yaml +++ b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/service.yaml @@ -5,8 +5,8 @@ metadata: app.kubernetes.io/instance: external-secrets app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: external-secrets - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 name: external-secrets-metrics namespace: syn-external-secrets-operator spec: diff --git a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/serviceaccount.yaml b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/serviceaccount.yaml index e342ad1..6a28cd1 100644 --- a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/serviceaccount.yaml +++ b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/serviceaccount.yaml @@ -5,7 +5,7 @@ metadata: app.kubernetes.io/instance: external-secrets app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: external-secrets - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 name: external-secrets namespace: syn-external-secrets-operator diff --git a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/servicemonitor.yaml b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/servicemonitor.yaml index ff633d6..d4ca37e 100644 --- a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/servicemonitor.yaml +++ b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/servicemonitor.yaml @@ -5,8 +5,8 @@ metadata: app.kubernetes.io/instance: external-secrets app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: external-secrets - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 name: external-secrets-metrics namespace: syn-external-secrets-operator spec: @@ -31,8 +31,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/metrics: webhook app.kubernetes.io/name: external-secrets-webhook - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 name: external-secrets-webhook-metrics namespace: syn-external-secrets-operator spec: @@ -58,8 +58,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/metrics: cert-controller app.kubernetes.io/name: external-secrets-cert-controller - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 name: external-secrets-cert-controller-metrics namespace: syn-external-secrets-operator spec: diff --git a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/validatingwebhook.yaml b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/validatingwebhook.yaml index 0d80e27..6ab13de 100644 --- a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/validatingwebhook.yaml +++ b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/validatingwebhook.yaml @@ -6,9 +6,9 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/metrics: webhook app.kubernetes.io/name: external-secrets-webhook - app.kubernetes.io/version: v2.8.0 + app.kubernetes.io/version: v2.14.0 external-secrets.io/component: webhook - helm.sh/chart: external-secrets-2.8.0 + helm.sh/chart: external-secrets-2.14.0 name: secretstore-validate webhooks: - admissionReviewVersions: @@ -68,9 +68,9 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/metrics: webhook app.kubernetes.io/name: external-secrets-webhook - app.kubernetes.io/version: v2.8.0 + app.kubernetes.io/version: v2.14.0 external-secrets.io/component: webhook - helm.sh/chart: external-secrets-2.8.0 + helm.sh/chart: external-secrets-2.14.0 name: externalsecret-validate webhooks: - admissionReviewVersions: diff --git a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/webhook-deployment.yaml b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/webhook-deployment.yaml index ff09c35..4b2f11b 100644 --- a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/webhook-deployment.yaml +++ b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/webhook-deployment.yaml @@ -6,8 +6,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/metrics: webhook app.kubernetes.io/name: external-secrets-webhook - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 name: external-secrets-webhook namespace: syn-external-secrets-operator spec: @@ -24,8 +24,8 @@ spec: app.kubernetes.io/managed-by: Helm app.kubernetes.io/metrics: webhook app.kubernetes.io/name: external-secrets-webhook - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 spec: automountServiceAccountToken: true containers: @@ -39,7 +39,7 @@ spec: - --healthz-addr=:8081 - --loglevel=info - --zap-time-encoding=epoch - image: ghcr.io/external-secrets/external-secrets:v2.8.0 + image: ghcr.io/external-secrets/external-secrets:v2.14.0 imagePullPolicy: IfNotPresent name: webhook ports: diff --git a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/webhook-secret.yaml b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/webhook-secret.yaml index b19ea22..faf5b6a 100644 --- a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/webhook-secret.yaml +++ b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/webhook-secret.yaml @@ -6,8 +6,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/metrics: webhook app.kubernetes.io/name: external-secrets-webhook - app.kubernetes.io/version: v2.8.0 + app.kubernetes.io/version: v2.14.0 external-secrets.io/component: webhook - helm.sh/chart: external-secrets-2.8.0 + helm.sh/chart: external-secrets-2.14.0 name: external-secrets-webhook namespace: syn-external-secrets-operator diff --git a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/webhook-service.yaml b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/webhook-service.yaml index b53261e..947eae2 100644 --- a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/webhook-service.yaml +++ b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/webhook-service.yaml @@ -6,9 +6,9 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/metrics: webhook app.kubernetes.io/name: external-secrets-webhook - app.kubernetes.io/version: v2.8.0 + app.kubernetes.io/version: v2.14.0 external-secrets.io/component: webhook - helm.sh/chart: external-secrets-2.8.0 + helm.sh/chart: external-secrets-2.14.0 name: external-secrets-webhook namespace: syn-external-secrets-operator spec: diff --git a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/webhook-serviceaccount.yaml b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/webhook-serviceaccount.yaml index e4e2d22..cb35ad6 100644 --- a/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/webhook-serviceaccount.yaml +++ b/tests/golden/openshift/external-secrets-operator/external-secrets-operator/10_helm_chart/external-secrets/templates/webhook-serviceaccount.yaml @@ -6,7 +6,7 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/metrics: webhook app.kubernetes.io/name: external-secrets-webhook - app.kubernetes.io/version: v2.8.0 - helm.sh/chart: external-secrets-2.8.0 + app.kubernetes.io/version: v2.14.0 + helm.sh/chart: external-secrets-2.14.0 name: external-secrets-webhook namespace: syn-external-secrets-operator